V is for Volt Typhoon — The Intruder That Broke In to Wait

The Alphabet of Actors — Letter V. A named-entity dossier: who they are in the record, what the LSN systems catch of their kind today, and a status verdict — ACTIVE, DEFUNCT, REBRANDED, PROSECUTED, ABSORBED, INDICTED, DISBANDED, EXPOSED, DISSOLVED, UNDETERRED, NORMALIZED, SANCTIONED, CAUGHT, EVOLVING, TAKEN DOWN, IMMORTAL, LIABLE, UNMASKED, NAMED, UNINSTALLED, ARRESTED, WEAPONIZED, DECAPITATED, BURROWED, PRE-POSITIONED.

Every actor in this register broke in to do something — steal money, read secrets, encrypt files, turn off the lights. Volt Typhoon broke in to do nothing. That is not a joke and not a relief; it is the most unsettling thing in the whole alphabet. Volt Typhoon is a Chinese state actor that has spent years quietly establishing access inside the systems that run American water, power, communications, and transportation — and then, having gotten in, it has largely just... stayed. It has not stolen much of value. It has not caused a blackout. It has settled into the infrastructure and waited, and the assessment of the United States government and its allies is that it is waiting for a war.

Volt Typhoon — tracked also as Bronze Silhouette, Vanguard Panda, and Insidious Taurus — is the register's turn away from the Russian services of the last several letters and toward China, and toward a kind of threat none of the others quite represents. It is not espionage, though it looks like it. It is not destruction, though destruction is the point. It is pre-positioning: the deliberate, patient establishment of a foothold inside critical infrastructure so that, if a crisis comes — most plausibly a conflict over Taiwan — the access is already there, and the water treatment plant or the power substation or the port that America would need in that moment can be reached and disrupted from the inside, on command. The intrusion is not the attack. The intrusion is the loaded gun, placed years in advance, against the day someone decides to fire it.

This is the letter about the threat that has not happened yet and is more frightening for it, about an actor so disciplined it uses almost no malware at all, and about the uncomfortable discovery that the quiet neglected router in the corner of a small office is the same device a nation-state uses to hide a hand on the switch of a country's infrastructure.

1. The Actor: the intruder who does nothing

To understand why Volt Typhoon is different you have to understand what it does not do, because the absence is the whole story. When a criminal breaks into a network, they steal or encrypt, and quickly, because dwell time is risk. When a classic spy breaks in, they collect — they exfiltrate documents, read email, harvest secrets, and the outflow of data is the signature that eventually gives them away. Volt Typhoon, inside the networks of American critical infrastructure, does remarkably little of either. It gets in, it establishes durable access, it moves quietly to understand the environment, and then it holds — dwell time measured, in some networks, in years. No mass theft. No ransom. No blackout. Just presence.

That absence of obvious activity is precisely what makes the intent so alarming once it is named. If you break into a power company and steal its business secrets, you are a spy. If you break into a power company and do nothing but ensure you can still get in tomorrow, and next year, and quietly map how its control systems work, then you are not there for what the network knows. You are there for what the network does. The value of the access is not the information inside it; it is the physical thing the network controls — the flow of electricity, the treatment of water, the movement of trains and ships. An intruder who wanted secrets would have taken them and left. An intruder who takes nothing and simply stays is an intruder who wants to be there later, at a moment of their choosing, when taking nothing turns into taking everything offline.

This is the reframing the letter exists to deliver. The register has trained the eye to ask, of any intrusion, "what did they steal?" Volt Typhoon breaks the question. The right question here is not what was taken but what was prepared, and the answer is a capability held in reserve inside the systems a nation depends on to function — the cyber equivalent of an agent who crosses a border in peacetime, takes a job near the dam, and waits, for years, for a war that may never come, so that if it does, he is already standing where he needs to be.

2. The Purpose: a loaded gun against a war over Taiwan

The assessment of what Volt Typhoon is for is not a private inference; it is the stated judgment of the United States government and its closest allies, and this section reports it plainly because the purpose is the point of the whole profile.

In February 2024, a joint advisory from the United States' CISA, NSA, and FBI, together with the intelligence agencies of the Five Eyes partners, made the assessment explicit: Volt Typhoon had compromised the networks of US critical infrastructure and was pre-positioning itself to enable disruptive or destructive effects in the event of a major crisis or conflict with the United States. Read against the broader strategic picture the archive documents — the ODNI's annual assessment of China's posture, the Microsoft reporting on Guam — the shape of the scenario is clear. The most plausible crisis is a conflict over Taiwan. In that scenario, the United States would need to mobilize military force across the Pacific, and much of that mobilization runs through civilian infrastructure: the power that runs the bases, the water and transportation and communications of the ports and cities that project American power, and above all the infrastructure of Guam, the strategic hub of any US response in the region. Volt Typhoon's target set maps onto exactly that.

So the purpose, as assessed, is not to spy on that infrastructure but to be able to break it at the decisive moment. If China moved on Taiwan and the United States moved to respond, Volt Typhoon's pre-positioned access could be activated to disrupt the water, the power, the communications that American mobilization depends on — to slow the response, to complicate the logistics, and, not incidentally, to sow fear and confusion in the American homeland by making the lights flicker and the taps run dry far from any battlefield. It is a weapon aimed not at winning the cyber fight but at shaping the physical war: degrade the enemy's ability to move, and rattle its population, in the hours that matter most. The intrusions are quiet now because their whole value is in staying undiscovered until they are needed. Pre-positioning only works if no one clears you out before the day you were placed there for.

3. The Method: living off the land

What makes Volt Typhoon so hard to find, and so distinct in a register full of malware, is that it barely uses any. Its signature technique is called living off the land, and understanding it explains both why the actor is so dangerous and why it leaves such a faint trace in an archive like this one.

Most intrusions involve tools the attacker brings — malware, implants, custom programs that do the stealing or the spreading. Those tools are foreign objects in a system, and foreign objects can be detected: a signature written for the malware, a file that should not be there, a process that does not belong. Living off the land discards the foreign tools entirely. Instead of bringing malware, Volt Typhoon uses the tools that are already on the target system — the legitimate, built-in administrative utilities that every Windows environment contains: PowerShell, WMI, the network-configuration and directory tools that real administrators use every day. Combined with valid credentials stolen from the environment, this lets the intruder operate as what looks, to any monitoring, like a normal administrator doing normal work. There is no malicious file to flag, because there is no malicious file — only legitimate tools used by an illegitimate hand, and stolen-but-valid logins that raise no alarm.

The consequence is a detection problem that inverts everything defenders are used to. You cannot write a signature for PowerShell, because PowerShell is supposed to be there; you cannot block WMI, because your own administrators need it. Catching Volt Typhoon requires not looking for a known-bad thing but noticing that a known-good thing is being used in a subtly wrong way — an admin tool run at an odd hour, a valid account logging in from a slightly wrong place, a pattern of legitimate commands that adds up to something no real administrator would do. That is behavioral hunting, and it is far harder, slower, and more expensive than matching a fingerprint. It is also why this letter is nearly the only one in the register with no malware signature at its center: Volt Typhoon's genius is to be a threat that carries no weapon, only the quiet misuse of the tools the victim cannot live without.

4. The Infrastructure: a hand hidden in the neglected router

There is one place Volt Typhoon does leave a physical trace, and it is the place that ties this letter, unexpectedly and completely, to the honeypot beneath these words — so this section follows the thread, because it is the register's sharpest connection between the marquee threat and the daily one.

To reach American networks without its traffic obviously coming from China, Volt Typhoon needed to hide where its connections originated. It solved this the way sophisticated actors increasingly do: by routing its command-and-control through a network of compromised small-office and home-office routers — the cheap networking boxes in dentists' offices and small businesses and homes — that it assembled into what researchers named the KV Botnet. And crucially, the devices it favored were end-of-life: routers and edge devices from Cisco, NetGear, Fortinet and others that the manufacturers had stopped supporting and patching, still humming away in corners because no one had replaced them. By compromising these forgotten, unpatched, in-region devices, Volt Typhoon made its nation-state traffic appear to come from an ordinary American small business, blending into the local noise.

Now recall letter M. The honeypot beneath these words watches, every single day, exactly this class of device being brute-forced and recruited — the insecure, default-credentialed, end-of-life routers and cameras and DVRs that the Mirai genus conscripts by the tens of thousands into commodity botnets. That is the loud, mass, criminal end of the same phenomenon. Volt Typhoon is the quiet, strategic, state end. Both are drawing water from one well: the vast global supply of insecure, unpatched, forgotten edge devices that no one takes responsibility for. The difference is only who does the taking and why. When Mirai takes the neglected router, it becomes a soldier in a denial-of-service flood. When Volt Typhoon takes the same router, it becomes a link in the chain that hides a nation-state's hand on the switch of a power grid. Letter V is what the neglected device of letter M becomes when the intruder is a government preparing for war rather than a criminal chasing a botnet — and it is the clearest proof in this register that the honeypot's unglamorous daily traffic and the highest-stakes geopolitics are made of the same insecure hardware.

5. The Disruption, and Its Limit

Volt Typhoon did suffer a real blow, and it deserves an honest accounting, because the blow and its limit together define the letter's verdict.

In a court-authorized operation over the turn of 2023 into 2024, the FBI moved against the KV Botnet — the proxy layer of compromised routers. Much as it had done with QakBot and with the Snake network, the Bureau reached into the hundreds of compromised US small-office and home-office routers, removed the Volt Typhoon malware from them, and severed their connection to the botnet, cutting off that avenue of obfuscation. It was a genuine operation with a genuine effect: the specific infrastructure Volt Typhoon had built to hide its traffic was dismantled, and the compromised devices of hundreds of unwitting Americans were cleaned.

But notice exactly what was struck, because the distinction is everything. The FBI cleaned the proxy layer — the routers Volt Typhoon used to conceal where its connections came from. It did not, and by the nature of the operation could not, evict Volt Typhoon from the critical-infrastructure networks it had actually pre-positioned inside. Those footholds — the living-off-the-land access deep in the systems of water and power and communications companies — are a separate and far harder problem, and the government's own assessment is that Volt Typhoon's access to critical infrastructure persists. So the honest picture is a partial victory of a familiar shape: the obfuscation infrastructure was taken down, which raises the actor's costs and blinds one of its methods, but the intruder is still inside the buildings that matter, still pre-positioned, still waiting. The botnet was cleaned; the hand on the switch was not removed. Against pre-positioning, cleaning the proxy is like finding and removing the spy's disguise while the spy remains at his post near the dam. Useful, real, and not the same as making him leave.

6. The counter-narrative, steelmanned

The strongest challenge to this letter attacks its central claim — the intent — and it deserves a rigorous hearing, because intent is exactly the part that is not proven.

The argument runs like this. Everything solid about Volt Typhoon is the access; everything alarming about it is an assessment of purpose that no attack has ever borne out. Pre-positioning for wartime disruption is an inference — a reading of why an actor might be quietly sitting in infrastructure — and the far more mundane explanation is that this is simply espionage, or contingency access of the kind every major power maintains in every other major power's systems, the United States emphatically included. China, for its part, flatly denies the attribution and calls the whole Volt Typhoon narrative American disinformation designed to justify surveillance budgets and inflame tension over Taiwan. And there is a real epistemics problem the letter must own: an actor that "does nothing" is being convicted of the worst possible intent precisely because it does nothing, which is unfalsifiable in an uncomfortable way — quiet access is read as sinister patience, when quiet access is also just what careful espionage looks like. To treat an unproven capability as a loaded gun, the argument concludes, is to manufacture a casus belli out of an intrusion that has never actually harmed anyone.

The dossier grants the epistemic caution and holds the line where it matters. Yes, the intent is an assessment, not an adjudicated fact, and this letter says so plainly and repeatedly — the access is documented, the purpose is inferred, and China's denial is on the record; a reader should hold the "why" more loosely than the "what," and the register would be dishonest to blur them. And yes, contingency access is a game great powers all play, the US included, which the register has never pretended otherwise. But three things keep the alarm proportionate rather than manufactured. First, the assessment is not one analyst's hunch; it is the considered, coordinated judgment of the Five Eyes intelligence agencies, reading the target set — water, power, transportation, communications, Guam — that fits wartime disruption far better than it fits intelligence collection, because those systems hold little worth spying on and everything worth breaking. Second, the espionage alternative actually strains against the behavior: a spy in a water utility has little to steal, so persistent access to operational systems that produce no intelligence is better explained by an interest in the operation than in the information. Third, and decisively, the appropriate response to an assessed-but-unproven pre-positioning is not to assume the worst and escalate, but exactly what the letter does — state the access as fact, the intent as high-confidence assessment, name the denial, and treat the foothold as something to be found and removed regardless of intent, because access to a power grid is dangerous whatever the reason for it. The counter-narrative is right that we do not know the trigger will ever be pulled. It is wrong that this means the loaded gun in the infrastructure can be safely ignored.

7. Verdict — PRE-POSITIONED, and WAITING

Volt Typhoon is the letter of the threat that has not happened — the Chinese state actor that broke into the water, the power, the communications, and the transportation of the United States, and then, with a discipline that used almost no malware and left almost no trace, did nothing but stay. It is not a spy after secrets or a saboteur after a headline; it is a hand placed quietly inside the machinery a nation runs on, years before the day it might be needed, against a war that has not yet come.

The verdict's first word is what it actually did, in the precise language of the agencies that found it: PRE-POSITIONED. Not stolen, not destroyed — positioned, in advance, inside critical infrastructure, so the access would already exist at the decisive moment. This is a category the register had not yet named: the intrusion whose value is not what it takes but what it prepares, the loaded gun placed in peacetime against a wartime trigger. Volt Typhoon is the clearest instance in the alphabet of a compromise that is dangerous not for anything it has done but for everything it has made possible.

The second word is the state it now holds, and the reason it is so hard to answer: WAITING. There is no attack to point to, no damage to tally, because the whole design is patience — to sit undiscovered in the infrastructure until a crisis makes the access worth spending. The FBI cleaned its botnet of proxy routers, a real blow, and did not remove it from the networks that matter; the access persists, and so the waiting persists. You cannot deter an intruder who has not yet acted, you cannot easily evict one who carries no malware to find, and you cannot un-worry a nation once it knows the gun is in the room. Volt Typhoon simply waits, and the waiting is the weapon.

Twenty-four letters deep, Volt Typhoon is the register's proof that the worst threats are sometimes the quietest, and its sharpest reminder that the honeypot's daily grind is not separate from the highest stakes. The platform beneath these words cannot see Volt Typhoon inside a water utility — living off the land, it carries nothing to catch — but it sees, every single day, the exact class of neglected end-of-life router that Volt Typhoon compromised to hide itself: the same insecure edge device the Mirai genus of letter M recruits by the thousands. The commodity botnet and the state pre-positioner drink from one well of unpatched hardware, and the difference is only the hand that reaches in. The vectors do not lie: the access is real, the target set is infrastructure, the tradecraft is invisible, the intent is assessed, and the intruder is still inside. Judge the actor that broke in to wait. Then patch the forgotten router in the corner — because it is the same device in both stories, and the only thing that decides whether it ends up in a criminal's flood or a nation's opening move of a war is whether someone remembers it is there.

The Alphabet of Actors continues. Verdict: PRE-POSITIONED, and WAITING. Confidence: HIGH on the attribution of Volt Typhoon to the PRC and on the documented compromises of US critical infrastructure — a multi-government / Five Eyes assessment; the pre-positioning intent is a high-confidence government assessment inferred from access patterns and strategic context, not an adjudicated fact — no destructive attack has occurred, and China denies the attribution, a denial recorded here. No individuals are charged or named. US critical-infrastructure operators and the owners of the compromised routers are centered as the affected parties. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges the intruder that prepared rather than acted, the tradecraft that carried no weapon, and the neglected device that is the same in the botnet and the war.