The Volt Typhoon has been living inside American water, power, and communications networks for years, stealing nothing, breaking nothing, deploying no malware. It is waiting. And the thing you cannot see doing damage is the hardest thing in security to find.
On a Friday afternoon in late 2023, the assistant general manager of a small municipal electric and water utility in Massachusetts got a phone call from the FBI.
The call was not a warning about something that might happen. It was a notification. Chinese state-sponsored hackers had been living inside the utility's network, and the utility had no idea. They hadn't been alerted by an outage, a ransom note, or a data leak. The intruders had taken nothing and broken nothing.
That is the entire problem with the Volt Typhoon. The victim didn't discover the breach. The FBI did. And by the time anyone knew, the attacker had already been resident long enough to be exactly where they wanted to be.
Every other serious threat actor eventually does something you can measure. Ransomware encrypts. Espionage groups exfiltrate. Extortion crews publish. The damage is the signal.
The Volt Typhoon inverts that. This is a Chinese state-sponsored group, active since at least mid-2021, and tracked under a shelf of names, Vanguard Panda, BRONZE SILHOUETTE, Voltzite, Insidious Taurus.
Its purpose is not theft and not disruption today.
US, UK, and allied intelligence agencies assess its behaviour as pre-positioning: quietly establishing durable access inside critical infrastructure, power, water, communications, transportation, so that if a conflict comes, particularly one over Taiwan, the access is already there to disrupt those services at the moment it would hurt most.
Read that carefully, because it changes what "detection" even means. The objective isn't speed or profit. It's access, persistence, and optionality, the option to cause harm later. Which means the attack you're trying to catch produces, by design, almost no harm now. There is no encryption to spot, no bulk exfiltration to flag, no malware signature to match. There is only a legitimate-looking presence, doing legitimate-looking things, very slowly, for a very long time.
Independent researchers confirmed Volt Typhoon continued targeting US utilities through 2025, and in February 2026 CISA issued a supplementary advisory noting activity had intensified since mid-2025, with fresh indicators in the water and communications sectors, language explicitly tied to "pre-conflict positioning."
The group is, as far as anyone can tell, still inside.
Most intrusions get caught because the attacker brings foreign objects into your environment, a malicious file, an unusual binary, a beacon to a known-bad server. Signature-based tools are built to spot the foreign object.
The Volt Typhoon brings nothing. Their defining tradecraft is living off the land (LOTL). Instead of deploying custom malware, they use the administrative tools already built into Windows and your network gear, Wmic, PowerShell, Netsh, and Ntdsutil. Every command they run is a command a real administrator legitimately runs. There is no malware to find because they never brought any.
Then they compound the invisibility in three ways:
They log in; they don't break in. After the initial compromise they operate with valid stolen credentials, so their sessions authenticate cleanly. To your identity systems, it's just an admin doing admin things.
They enter through the devices you're not watching. Their favourite initial access point is the edge, routers, firewalls, and VPN appliances, especially end-of-life or unpatched ones, plus a botnet of hijacked home and small-office routers (the KV Botnet) used as proxies, so their traffic appears to originate from ordinary residential users in your own country rather than from China.
They match your rhythm on purpose. This is the detail that should unsettle you most. Volt Typhoon has been observed using stolen credentials only during the victim's normal business hours, deliberately blending into legitimate activity patterns, specifically to defeat anomaly detection that looks for odd-hours behaviour. They studied what normal looks like in your environment, and then they became it.
So the usual tell tale signs are all suppressed. No malware. No invalid logins. No traffic from suspicious geographies. No 3 a.m. activity. An adversary that has removed every individual red flag on purpose.
Which leaves exactly one way to catch them: not the object, and not any single event, but the sequence, the shape of a series of individually legitimate actions that, taken together, no real administrator would ever produce. That is the entire defensive argument, and it's what the rest of this is about.
Follow two people. Ravi is the network administrator at a regional water utility; his credentials and his daily habits are what the attacker wants to wear. Elena runs the SOC, and her problem for most of this attack is that nothing looks wrong.
What the attacker does. Long before any login, they study the utility from outside, its internet-facing systems, its working hours, its layout, to plan a path that won't stand out. Then they get in through an exposed edge device: a router or VPN appliance with a known, unpatched vulnerability. They may also change its configuration or firmware to plant a quiet backdoor, and route their traffic through hijacked home routers so it looks like it's coming from a normal broadband customer.
Where Invinsense steps in. The SIEM, the system that pools firewall, VPN, identity, and endpoint logs into one place, correlates perimeter telemetry to spot the reconnaissance: a single external IP probing many public-facing ports or URLs in a short window is someone mapping the perimeter, not a normal user.
More important is the management plane. Access attempts against firewall, router, and VPN admin interfaces from unexpected address ranges or outside maintenance windows, and, the signature Volt Typhoon detection, an unplanned configuration change, firmware update, or reboot on an edge device.
Legitimate config changes come with change tickets. One that doesn't, on a device UEMP (the exposure-management module) already flags as high-risk, is treated as a compromised entry point.
SOAR can roll back the config, force credential rotation on the device, and restrict its external access.
This matters because the edge is the one place Volt Typhoon does leave a mark, the config change is a physical event in a log, even when everything after it is invisible.
What the attacker does. With the edge device compromised, they set up VPN-style remote access and began operating as if they were a legitimate remote user. They deliberately use the protocols and ports your firewall already permits, HTTPS, standard VPN, so basic network tools wave them through.
Where Invinsense steps in. The tell isn't the protocol; it's who is speaking it and for how long. The SIEM, fed per-process network telemetry by UEC (the endpoint agent), flags an internal server or workstation that suddenly maintains a long-lived outbound session to an unfamiliar destination, a machine that has no history of initiating such traffic doing exactly that. A web server does not normally open a persistent encrypted tunnel to a residential IP. When it does, SOAR can have the UEC agent kill the tunnelling process, isolate the host, and push a firewall block for the destination.
What the attacker does. Now they go after the keys to everything: high-privilege admin, service, and domain credentials. They dump them from LSASS, the Windows process holding live passwords and tokens in memory, using tools like Procdump or the Rundll32 + Comsvcs technique. On a domain controller, they go bigger, using Ntdsutil or Vssadmin to copy NTDS.dit, the file containing the entire Active Directory password database, to carry off and crack offline.
Where Invinsense steps in. This is one of the few loud moments, and the platform treats it as such. UEC logs any process opening lsass.exe with read or full-access rights when it isn't a known security tool, and watches for LSASS dump files (.dmp) appearing in temp or user directories. Separately, and this is the higher-severity one for an infrastructure target, it detects Ntdsutil, Vssadmin, and Wbadmin running with export or backup parameters, and a copy of ntds.dit appearing in an unusual folder. Almost nothing legitimate copies the entire AD database to a temp directory. UEC can block untrusted processes from reading LSASS outright and prevent ntdsutil from running outside a maintenance window; SIEM and SOAR lock the affected accounts and isolate the host.
What the attacker does. This is the heart of the Volt Typhoon, and the hardest part to see. Using nothing but built-in tools, Wmic, PowerShell, Netsh, Ntdsutil, they map the environment, query Active Directory, and identify the systems that matter. Then they move sideways using the protocols administrators already use every day: RDP, SMB, WMI, WinRM. As Ravi. During business hours. With his real credentials.
Where Invinsense steps in. You cannot flag Wmic or RDP as malicious, Ravi uses them hourly. So the platform does the only thing that works: it learns Ravi, and it correlates. UEC captures every process and command line and flags powerful built-in tools showing up where they don't belong, a Netsh portproxy command (used to set up covert forwarding) on a normal endpoint, Ntdsutil on a machine that isn't a domain controller, encoded or obfuscated PowerShell, Wmic launched by a non-admin account. UEBA (User and Entity Behaviour Analytics, a learned baseline of who uses which tools, from where, and when) raises the deviations: a user laptop suddenly running AD-backup commands, an account starting Wmic for reconnaissance it has never run before.
And then the correlation that actually catches this group: two behaviours chained on the same host. First, LOLBin or PowerShell recon, AD queries, Netsh, Wmic. Then, shortly after, new RDP, SMB, or WMI connections fanning out to multiple internal systems the host doesn't normally talk to. Either alone is arguable. The pair, in that order, is an attack path. The SIEM reconstructs the full east-west route, which account hopped to which host, in what sequence, from combined NetFlow, NDR, and Windows logon data.
Ravi runs Wmic. Ravi does not run Wmic, then immediately RDP to nine servers in the OT network he has never logged into before.
What the attacker does. They ensure a reboot doesn't evict them — but using "normal" methods, not noisy implants: a new service, a scheduled task, a WMI event subscription, a web shell hidden on an existing web server, or simply a standing VPN account. On critical systems, resident for months.
Where Invinsense steps in. UEC reports every new service, scheduled task, and WMI subscription to the SIEM, which flags those created on domain controllers and key servers, by unusual accounts, or outside change windows, correlated with asset criticality and UEMP exposure data, so a new task on a high-value system is weighted far more heavily than one on a test box. For web shells, the SIEM ingests web-server and WAF logs to detect rare script paths and command-like input patterns, correlated with odd process activity on the server. SOAR can auto-remove a rogue task, quarantine a web shell file, or roll back the change.
What the attacker does. They clear Windows event logs or tamper with audit settings to erase evidence. And then, the part that defines them, they wait. Deeply embedded, low-volume, periodically touching the systems that would matter in a crisis: the IT accounts quietly reaching toward OT, the control systems for water, power, communications. For months. For years.
Where Invinsense steps in. Log clearing is one of the clearest late-stage tells, because it has no legitimate everyday purpose: the SIEM fires immediately on security or system log clearing and on audit-policy changes with no corresponding approved ticket, and on the sudden loss of log forwarding from a host, silence itself becomes a signal.
But the detection that fits Volt Typhoon specifically is the one built for the long wait. Over weeks and months, the platform looks for the same account touching the same high-value systems periodically, in small amounts, especially where UEMP shows known exposures, and for rare IT-to-OT access: an IT account reaching an OT jump host or an ICS/SCADA node when that pattern is unusual for that user. On any single day, none of these alerts. Assembled across time, it tells the story of a quiet, long-running presence positioning itself near the systems that matter. This is the piece signature tools structurally cannot do: they evaluate a moment, and Volt Typhoon hides in the gaps between moments.
Look at what actually triggered each stage. An edge device rebooted outside its change window. A web server opened a long-lived tunnel to a home IP. ntds.dit appeared in a temp folder. Wmic recon was followed by an RDP fan-out. A scheduled task was created on a domain controller by the wrong account. The Security log was cleared.
Not one of those is a malware detection, because there is no malware. Not one is an odd-hours anomaly, because they worked bankers' hours on purpose. Each is a legitimate action made suspicious only by context, who did it, on what asset, in what order, against a baseline of what that person and that machine normally do. That context is the only thing Volt Typhoon didn't know how to erase, because it lives in your environment's history, not in their toolkit.
Individually, every signal here is undeniable. Chained, edge anomaly, then first internal pivot, then LOTL recon, then lateral fan-out toward OT, then log clearing, they become a narrative of pre-positioning, caught while it is still just positioning.
Three honest limits, and for this adversary they're sharper than usual.
Unpatched edge devices are the root cause, and detection is the fallback. Volt Typhoon's front door is the exposed, end-of-life router or unpatched VPN appliance. Catching what they do after they're through it is real value — but it is the second line, and a worse position than simply not having an internet-facing device with a known CVE. No SIEM makes edge patching and end-of-life replacement optional. If your perimeter gear is out of support, this group has a way in that correlation can only shorten, not close.
"They match your baseline" cuts both ways. Behavioral detection depends on a clean baseline of normal. The Volt Typhoon deliberately mimics normal, and if they were resident before your baseline was built, some of their activity may have been learned as normal. Onboarding baselines should be treated with suspicion in an environment that may already be compromised, and paired with proactive threat hunting rather than trusted blindly.
Low-and-slow means detection is probabilistic, not certain. An adversary touching one system, lightly, once a month is operating below the natural noise floor of a busy network. Correlation across months genuinely surfaces this, but anyone who promises certainty against an actor optimised specifically to stay under thresholds is overselling. The honest claim is that you dramatically raise their cost and shorten their dwell time, not that you make them impossible.
And a fourth point that isn't a product limitation but belongs here: for critical infrastructure, detection is necessary but not sufficient. Network segmentation between IT and OT, jump-server-only access to control systems, phishing-resistant MFA, and offline-recoverable backups are what determine whether a detected intrusion is an incident or a catastrophe. The tooling finds them faster; the architecture decides what they can do in the time they have.
The most dangerous breach your organisation faces this year may be the one doing absolutely nothing right now.
That is the uncomfortable lesson of the Volt Typhoon. We have trained a decade of security tooling to look for damage, the encryption, the exfiltration, the outage, and built an entire industry around spotting the moment an attacker acts. This adversary's whole strategy is to never act until it counts, and to look exactly like your own administrators until then. They removed every red flag we taught our tools to find, and then they waited.
What they could not remove is the shape of their behaviour over time, an edge device that changed when it shouldn't have, a credential that walked a path it never walks, a quiet reach from IT toward the systems that keep the lights on. That shape is only visible if you are watching the sequence, across identity, endpoint, network, and the edge, over weeks rather than seconds.
So the question for anyone running critical infrastructure was never "has something bad happened yet?"
It's "if a foreign government were already inside, waiting, patient, credentialed, and indistinguishable from our own admins, would we see the shape of them before the day they decide to stop waiting?"
Discover complete cybersecurity expertise you can trust and prove you made the right choice!
