Volt Typhoon Hits Multiple Electric Utilities, Expands Cyber Activity

Dragos reports that Voltzite, the OT-focused activity of the China-linked Volt Typhoon APT, has maintained long-term clandestine access to multiple US electric utilities, telecoms, and emergency services, exfiltrating OT- and SCADA-related data and using living-off-the-land techniques (e.g., csvde.exe, Volume Shadow Copy to steal NTDS.dit, web shells, FRP) to avoid detection; while no successful disruption of ICS has been observed yet, the adversary is pre-positioned to enable future disruptive operations against critical infrastructure.