What Makes Volt Typhoon Different
For most of the last decade, the serious threats to critical infrastructure were defined by custom malware built for industrial systems. TRITON, Industroyer, and their relatives were recognizable because they introduced something foreign into the environment, and defenders learned to hunt for the artifact that did not belong.
Volt Typhoon represents a different and, in some ways, harder problem. In February 2024, CISA, the NSA, the FBI, and international partners published advisory AA24-038A, describing a People's Republic of China state-sponsored group that had compromised IT environments across US communications, energy, transportation, and water and wastewater systems. The finding that reshaped many defenders' assumptions was the dwell time: the agencies assessed that in some cases the actors had maintained access for at least five years. They achieved this with almost no malware, relying instead on the tools already present on the target systems, a technique known as living-off-the-land, with the apparent goal of pre-positioning for potential disruption during a future crisis rather than causing an immediate effect.
Understanding this technique is now essential for OT security teams, because it is specifically effective against the defenses that most organizations rely on.
Understanding Living-off-the-Land
Living-off-the-land, commonly abbreviated LOTL, means operating with the legitimate binaries and features already installed on the target rather than introducing malware. These native utilities, sometimes called LOLBins, are the same tools administrators use every day, which is exactly why their misuse is difficult to detect. AA24-038A documented the toolkit Volt Typhoon used, and it is composed entirely of standard components:
ntdsutil, a legitimate Active Directory management tool, used to extract the domain database (NTDS.dit) from domain controllers, which contains the credentials for the entire domain.wmicandPowerShell, standard Windows management and scripting tools, used for remote execution and to discover the environment.netsh, a native networking utility, used to configure port proxies that pivot traffic through compromised hosts.- Valid, stolen credentials, so that subsequent activity appears to be the authorized work of a legitimate account.
Because these tools are legitimate and no malicious file is installed, there is no known-bad hash for antivirus to match and no foreign binary for an analyst to find. The activity resembles routine administration, which is precisely the intent.
The Volt Typhoon Campaign
The campaign's characteristics reveal a deliberate, patient strategy. For initial access, the group favored internet-facing edge devices. To conceal the origin of its activity, it routed operations through a network of end-of-life small office and home office routers, primarily Cisco RV320 and RV325 and NetGear ProSAFE devices, which it used as covert proxy infrastructure. These devices were attractive because, having reached end of life, they no longer received security updates. The FBI disrupted this KV Botnet in a court-authorized operation in January 2024, and the group was subsequently observed working to rebuild it.
The victim profile points to the objective. Volt Typhoon did not pursue data theft or ransom. It appears to have sought quiet, persistent access to the systems that societies depend on during a crisis, so that operations could be disrupted at a moment of the adversary's choosing. This is pre-positioning, and it reframes the risk: the relevant adversary is not only the one seeking a visible incident today, but the one aiming to remain undetected for years while retaining an option over operations.
Why Living-off-the-Land Defeats Traditional Defenses
The effectiveness of this technique comes from the fact that it sits outside the view of several widely used controls.
Signature-based antivirus looks for known-bad files, and here there are few or none.
Perimeter firewalls watch the boundary, but the adversary enters through authorized access and then operates internally with valid credentials.
Indicator-of-compromise feeds distribute malicious hashes and domains, which offer limited value against an actor using native tools and deliberately transient infrastructure such as compromised home routers.
Compliance checklists confirm that controls exist, but the presence of a control does not guarantee that the misuse of a legitimate feature will be noticed.
Defensive implication: Detecting this activity requires a shift from hunting foreign artifacts to recognizing anomalous behavior within legitimate activity. That is only possible when an organization has a clear understanding of what normal looks like.
Why OT Environments Are Especially Exposed
Operational technology environments offer particularly favorable conditions for a patient, quiet intruder, and for reasons unrelated to negligence.
These systems are built to run for decades without change, so a foothold established once can persist for a very long time. Many were never fitted with monitoring capable of noticing unusual behavior, because they were historically assumed to be isolated. And they are reached through trusted pathways, such as vendor remote connections, maintenance access, and IT to OT bridges, that appear legitimate. The relevant MITRE ATT&CK for ICS techniques here, including exploitation of remote services and use of valid accounts, likewise require no malware. The central concern is the migration path: a long-standing foothold in IT, built from native tools, can become the vantage point from which an adversary studies the environment and moves toward OT.
Detecting Living-off-the-Land Activity
Behavioral Baselining
Because OT networks are predictable, defenders can build a strong baseline of normal administrative behavior, covering which accounts perform privileged actions, from which hosts, at what times, and against which systems. Living-off-the-land activity tends to depart from that baseline in detectable ways, such as an Active Directory management tool running on a domain controller with no corresponding maintenance activity, or a valid account authenticating at an unusual hour from an unexpected host.
Defensive implication: Anomaly detection built on a well-established baseline is the single most effective counter to this technique.
Identity and Command-Line Telemetry
Because the adversary relies on valid credentials and native binaries, two data sources are especially valuable. Identity analytics surface anomalous authentication, unexpected accounts, and privilege changes. Process-execution and command-line logging, captured through mechanisms such as Windows Event ID 4688, reveal the actual commands passed to tools like wmic, ntdsutil, and PowerShell. This activity is far more visible in command-line arguments than in any file.
Defensive implication: Environments that do not capture command-line and process-creation telemetry are blind to the evidence that this activity actually generates.
Protocol-Aware OT Visibility
Detection depends on visibility. Passive OT monitoring that decodes industrial protocols provides the record of normal communication against which an anomaly becomes apparent. Building this visibility is one of the most impactful steps an operator can take.
Threat-Informed Hunting
Mapping detection coverage to MITRE ATT&CK and ATT&CK for ICS, and hunting proactively for the specific techniques AA24-038A documented, turns the advisory itself into a hunting guide. It names the tools, techniques, and behaviors to look for, which allows a defender to search for traces rather than wait for an alert that signature-based tools will never generate.
What OT Security Leaders Should Do
- Broaden the threat model. Recognize that the absence of a malware alert does not confirm safety, and account for the possibility of a quiet, persistent actor.
- Invest in visibility first, across both IT, through process and command-line logging and identity telemetry, and OT, through protocol-aware monitoring.
- Strengthen identity and remote access. Enforce phishing-resistant multi-factor authentication on remote and administrative access, minimize standing privilege, and record privileged sessions.
- Segment thoroughly, so that a foothold in IT does not translate into free movement toward the process. Every conduit an adversary must cross is another opportunity to detect them.
- Hunt against the advisory, using AA24-038A and ATT&CK for ICS to search for behavioral traces.
The Enduring Lesson
Volt Typhoon is significant not because of a clever piece of code, but because it demonstrated that the most capable adversaries targeting critical infrastructure may choose to be patient, quiet, and difficult to distinguish from routine administration. That reality rewards defenders who understand their environment deeply and invest in the visibility to notice when something ordinary begins behaving strangely.
The path forward is the same one that strengthens OT security against every serious threat: know your assets, watch your network and your identities, govern access carefully, and segment so that quiet persistence in one place does not become significant reach into another.
Beacon Security helps critical infrastructure operators build the visibility, identity controls, segmentation, and threat-informed detection needed to counter nation-state and living-off-the-land tradecraft in OT. Contact us to assess your detection readiness against AA24-038A.
