PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure

This joint advisory from CISA, NSA, and FBI details Volt Typhoon (a PRC-aligned APT) intrusions into U.S. critical infrastructure IT networks—primarily communications, energy, transportation, and water—where the actors use living-off-the-land techniques, valid credentials, exploitation of internet-facing appliances (including CVE-2022-42475), and FRP reverse-proxy malware to maintain long-term persistence and pre-position for potential disruptive access to OT systems; the report provides observed TTPs, IOCs, detection/hunt guidance, mitigations, and incident response recommendations.