PRC State-Sponsored Threat Actors (Volt Typhoon) Target Critical Infrastructure Entities

This advisory summarizes CISA and Arctic Wolf analysis of Volt Typhoon, a PRC‑linked APT actively intruding into U.S. critical infrastructure IT environments (communications, energy, transportation, water), using vulnerability exploits, credential theft, lateral movement and Active Directory compromise to pursue footholds and access OT assets; the bulletin documents observed TTPs, high‑risk targeted product classes (Fortinet, Ivanti, NETGEAR, Citrix, Cisco), and prescribes patching, phishing‑resistant MFA, and security awareness as mitigations.