Volt Typhoon in the wild

Volt Typhoon, a state-sponsored PRC cyber actor, has been observed engaging in intrusion, reconnaissance, and data exfiltration using living-off-the-land tools (e.g., tasklist.exe to enumerate processes/DLLs, mpcmdrun.exe to probe Windows Defender/CVE-2023-24934, and attempted wmic.exe execution); ThreatLocker documents the IoC timeline, notes wmic was blocked, and provides detection and mitigation recommendations including credential resets, command-line auditing, and ThreatLocker-specific controls.