Volt Typhoon Strikes Massachusetts Power Utility

Chinese APT Volt Typhoon (Voltzite) conducted a prolonged 2023 intrusion into the Little Electric Light and Water Departments (Massachusetts), maintaining persistence for well over 300 days to exfiltrate operational technology (OT) procedures and spatial layout data; FBI, CISA, and Dragos identified and removed the actor and recommended mitigations. The group leveraged SOHO router botnets and likely exploited Internet-facing VPN/firewall flaws for initial access, then used SMB traversal and RDP lateral movement to navigate the environment. Dragos advises improved asset visibility, patch management, network segmentation, and incident response planning, and warns Voltzite will continue targeting critical infrastructure.