VORANT. Threat Intelligence Sign in Get the full feed

FBI Warns Volt Typhoon Threatens US Infrastructure

elevated threat energytelecommunicationsinfrastructuregovernment-nationaltransportation

FBI Director Wray warns Chinese state-sponsored hackers, including Volt Typhoon, have pre-positioned in US critical infrastructure networks for potential future disruption.

FBI Director Christopher Wray, speaking at the Vanderbilt Summit on Modern Conflict and Emerging Threats, described the Chinese government's cyber activity against U.S. critical infrastructure as broad and unrelenting. He cited historical examples including 2011 reconnaissance against 23 pipeline operators, the 2021 Microsoft Exchange Server mass-exploitation campaign that deployed webshells across numerous sectors, and the more recent Volt Typhoon intrusions into telecommunications, energy, water, and other infrastructure networks, which the FBI assessed as pre-positioning for potential future disruptive attacks tied to tensions over Taiwan.

Wray detailed FBI-led disruption efforts, including a court-authorized operation with Microsoft to remove webshells from compromised Exchange servers, and a separate court-authorized operation to remove Volt Typhoon malware from infected routers and sever the actor's control of that botnet. He also referenced the SolarWinds supply-chain compromise as an example of hardware/software supply chain risk requiring vendor vetting.

The remarks are primarily a policy and awareness speech emphasizing public-private partnership, incident reporting, and resiliency planning rather than a new technical disclosure. No new indicators of compromise or vulnerabilities were disclosed; the piece reiterates known campaigns (Volt Typhoon, Exchange webshell attacks, SolarWinds) as illustrative examples of the sustained Chinese state-sponsored threat to U.S. critical infrastructure sectors.

Mentioned in this report

Threat actors Volt Typhoon
Malware Volt Typhoon malware
Campaigns Microsoft Exchange Server hack (2021)SolarWinds supply chain compromiseVolt Typhoon

Detection guidance

Web Shell Deployment via Compromised Exchange Server

ATT&CK T1505.003

Detects suspicious file write or execution activity in Exchange Server web directories typical of webshell post-exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Shell Deployment via Compromised Exchange Server
description: Detects file creation or modification in Exchange Server web application
  paths (ECP, OWA, etc.) with executable extensions, typical of post-exploitation
  webshell staging following supply-chain compromise or direct exploitation.
tags:
- attack.persistence
- attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
    - \Exchange\FrontEnd\HttpProxy\ecp\
    - \Exchange\FrontEnd\HttpProxy\owa\
    - \inetpub\wwwroot\
    TargetFilename|endswith:
    - .aspx
    - .asp
    - .jsp
    - .jspx
    - .php
  filter_legitimate_patching:
    Image|endswith:
    - \w3wp.exe
    - \svchost.exe
    - \update.exe
  condition: selection and not filter_legitimate_patching
falsepositives:
- Legitimate Exchange Server patching and maintenance operations
- Authorized security scanning or web application deployment
level: high
id: 5bdefe7b-c1bd-5220-8916-1cb2ae0cd13c
status: experimental
author: Vorant

Suspicious Command Execution from Exchange Web Paths

ATT&CK T1505.003

Detects command-line or script execution initiated from Exchange Server web application directories, indicative of webshell activity. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Command Execution from Exchange Web Paths
description: Detects process creation where the parent process or working directory
  is rooted in Exchange Server web application directories (ECP, OWA), indicating
  potential webshell execution post-compromise.
tags:
- attack.persistence
- attack.t1505.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \w3wp.exe
    CommandLine|contains:
    - cmd.exe
    - powershell.exe
    - wscript.exe
    - cscript.exe
    ParentCommandLine|contains:
    - \Exchange\FrontEnd\HttpProxy\ecp\
    - \Exchange\FrontEnd\HttpProxy\owa\
  filter_exchange_maintenance:
    Image|endswith:
    - \update.exe
    - \setup.exe
  condition: selection and not filter_exchange_maintenance
falsepositives:
- Exchange Server diagnostic or maintenance scripts run via w3wp.exe
- Authorized administrative tools executed within web application context
level: high
id: 62c67bca-71ad-55e0-9d9a-e1bbe567262b
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.fbi.gov/news/stories/chinese-government-poses-broad-and-unrelenting-threat-to-u-s-critical-infrastructure-fbi-director-says

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free