Internet Footprint of SOHO Devices Exploited by Volt Typhoon

Microsoft and allied agencies disclosed Volt Typhoon, a Chinese state-sponsored group active since mid‑2021 that conducts stealthy intrusions against US and Guam communications infrastructure. The actor leverages living‑off‑the‑land techniques and proxies traffic through compromised SOHO networking devices (notably routers with SSH/HTTP exposed) from vendors such as Cisco, Draytek, FatPipe, Netgear Prosafe, and Zyxel to evade detection.