# Cyber 9/12 students war-game Volt Typhoon grid attack

Published: 2025-12-15 · Severity: low · Sectors: energy, education, government-national, defense
Canonical: https://vorant.io/reports/5ba594b7-e2b8-5284-9715-929c310553c8/cyber-9-12-students-war-game-volt-typhoon-grid-attack

> A student policy competition simulated a fictional Volt Typhoon breach of US electric utilities and military bases to train future cyber crisis leaders.

This piece from the Atlantic Council's Cyber Statecraft Initiative recaps the tenth annual Cyber 9/12 Strategy Challenge, an educational exercise where university teams role-play as National Security Council policy advisors responding to a fictional cyber crisis. The 2025 scenario depicted the real-world Chinese state-sponsored group Volt Typhoon breaching multiple US electric utilities, cascading into outages affecting Air Force bases in Illinois, Missouri, California, Hawaii, and Guam, driven by legacy SCADA/ICS systems and unpatched public-facing VPNs/firewalls.

The article is not a threat report but a recap of student and judge reflections on lessons learned from the tabletop exercise, referencing real precedents (Colonial Pipeline, SolarWinds, NotPetya) as grounding examples for policy discussion. It emphasizes skill-building in crisis communication, cross-sector coordination, and international frameworks (Five Eyes, ASEAN, G7) rather than describing any actual ongoing intrusion or new technical finding.

From a threat-intelligence standpoint, there is no new indicator, vulnerability, or campaign disclosed here — Volt Typhoon is referenced only as the basis for a fictional training scenario reflecting known concerns about its historical targeting of US critical infrastructure and living-off-the-land techniques against ICS/OT environments.

## Mentioned in this report

- Threat actors: Volt Typhoon

Source reporting: https://www.atlanticcouncil.org/content-series/cyber-9-12-project/from-simulation-to-strategy-how-cyber-9-12-prepares-students-for-real-world-cyber-crises

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/5ba594b7-e2b8-5284-9715-929c310553c8/cyber-9-12-students-war-game-volt-typhoon-grid-attack.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup