# Volt Typhoon targets US critical infrastructure

Published: 2024-01-31 · Severity: routine · Sectors: energy, transportation, infrastructure, telecommunications
Canonical: https://vorant.io/reports/b8f8f229-bcd3-56b7-9c94-41d267c82015/volt-typhoon-targets-us-critical-infrastructure

> Chinese state hackers use Volt Typhoon malware to pre-position for sabotage of water, energy, transportation, and communications infrastructure.

FBI Director Christopher Wray disclosed that Chinese government-sponsored hackers, particularly those operating Volt Typhoon, are actively targeting U.S. critical infrastructure including water treatment plants, electrical grids, oil and natural gas pipelines, and transportation systems. The attackers are conducting pre-operational reconnaissance and network exploitation to position themselves to destroy or degrade civilian infrastructure in the event of conflict. On January 31, 2024, the FBI announced a significant disruption operation: working with partners and using court-authorized network operations, the Bureau identified and shut down Wi-Fi routers infected with Volt Typhoon malware and the command-and-control access it provided. Wray emphasized this is not a theoretical threat but an active, ongoing campaign targeting critical infrastructure across multiple sectors. The attackers are systematically preparing to inflict harm on American civilians by compromising the infrastructure that provides essential services.

## Mentioned in this report

- Threat actors: Volt Typhoon
- Malware: Volt Typhoon

Source reporting: https://www.fbi.gov/news/stories/china-s-hackers-have-entire-nation-in-their-crosshairs-fbi-director-warns

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/b8f8f229-bcd3-56b7-9c94-41d267c82015/volt-typhoon-targets-us-critical-infrastructure.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup