Volt Typhoon, US Critical Infrastructure Pre-positioning
2023 – 2024 (disclosed 2024)
Record reviewed: 2026-10-29
Executive Summary
PRC-linked threat actor assessed to be pre-positioning access in US critical infrastructure, including water, energy, communications, and transportation systems, as preparation for potential disruptive operations in a Taiwan contingency scenario. The most significant allied joint attribution in the dataset, involving all Five Eyes nations in coordinated advisories.
Why This Matters
Volt Typhoon represents the clearest case of peacetime pre-positioning in adversary critical infrastructure, forcing an urgent policy reckoning on whether such activity constitutes a threat of force and how states should respond to it below the threshold of armed conflict.
Escalation Profile
7-Dimension Profile
Escalation Ladder
Phases
Living-off-the-land access
Actor used legitimate credentials and native system tools to establish persistent access across US CI networks, avoiding traditional malware signatures.
Infrastructure mapping and pre-positioning
Activity consistent with mapping operational technology environments and maintaining access for future use, not immediate data exfiltration.
Thresholds Crossed
None of the five listed thresholds.
Significance
- •First publicly documented campaign of peacetime pre-positioning across multiple US critical infrastructure sectors simultaneously
- •Reframed the espionage/pre-attack distinction as a policy-urgent question
Restraint Factors
- •No disruptive or destructive actions observed, activity consistent with preparation, not execution
- •Living-off-the-land techniques suggest intent to avoid detection and maintain long-term access
Attribution Assessment
Threat actor mapped to China based on infrastructure analysis, malware attribution, and operational patterns.
Evidence: Microsoft: Volt Typhoon targets US critical infrastructure
- •Five Eyes joint advisory, the broadest allied attribution in the dataset (Feb 2024)
- •CISA Emergency Guidance for CI owners on Volt Typhoon detection
- •FBI disrupted Volt Typhoon botnet infrastructure (KV Botnet takedown, Jan 2024)
Sources: CISA/NSA/FBI Joint Advisory: Volt Typhoon; US DOJ: U.S. Government Disrupts Botnet People's Republic of China Used to Conceal Hacking of Critical Infrastructure
No dedicated journalistic sources in dataset. See sources section for full references.
“Confirmed” reflects available public evidence. All assessments carry inherent uncertainty and should be read alongside source material.
Unpeace Position
Unpeace Score
Severity on the peace–conflict spectrum (1–10): peak tier and thresholds crossed
Governance response (separate axis)
3 formal responses: public attribution, international cooperation, regulatory change. Analyst judgements: deterrence signal.
Unpeace · score breakdown
2/10Peak tier reached (intrusion), ranked 1–6.
None of the five listed thresholds.
1 + 9 × (1.2 × peak + thresholds − 1.2) ÷ 11, rounded (range 1–10, no cap; governance is a separate axis). These weights are an interpretive heuristic, not a validated metric — see the scoring methodology for rationale and limits.
Entanglement · score breakdown
5/10Distinct sectors in targetSectors.
ISO country codes in targetCountries.
Constant offset so a single-sector, single-country event scores 1.
clamp( sectors + countries − 1, 1, 10 ). These weights are an interpretive heuristic, not a validated metric — see the scoring methodology for rationale and limits.
Coercive Function
Espionage
Intelligence collection, coercive value lies in the information advantage gained and the implicit signal that the adversary can access sensitive systems.
Entanglement Risk
Sectors affected
Countries / regions
Impact summary
Persistent access established across US water, energy, communications, and transportation infrastructure; no disruption executed.
Infrastructure Meaning
Capability profile
Persistent access established across US water, energy, communications, and transportation infrastructure; no disruption executed.
3 ATT&CK techniques mapped — see ATT&CK mapping below.
Governance Analysis
Governance Flags
Norms invoked
- •Responsible state behavior in ICT use (UN OEWG)
- •Pre-positioning in critical infrastructure as a destabilizing activity
- •Due diligence obligations of states regarding their territory
Policy responses
- •Five Eyes joint advisory, the broadest allied attribution in the dataset (Feb 2024)
- •CISA Emergency Guidance for CI owners on Volt Typhoon detection
- •FBI disrupted Volt Typhoon botnet infrastructure (KV Botnet takedown, Jan 2024)
Regulatory changes
- •Directly shaped US National Cybersecurity Strategy implementation priorities
- •Accelerated CISA cross-sector risk management directives
- •Informed proposed critical infrastructure cybersecurity legislation
Governance impact assessment
Generated the most significant Five Eyes joint attribution to date and reframed critical infrastructure pre-positioning as the defining cyber threat of the current strategic environment, directly shaping US infrastructure security legislation.
Legal Dimensions
Rules whose application to this operation is debated in the literature. These are analytical questions, not findings — the Atlas records where a case sits in legal debate, it does not adjudicate legality (see methodology §09).
Tallinn Manual 2.0
- Rules 6 and 7, Due Diligence
Pre-positioning from Chinese infrastructure raises due diligence questions about both origin and target states
UN GGE Voluntary Norms (2015)
- Norm 13(a), Cooperation on Security
Five Eyes cooperation on joint advisory represents the most robust implementation of 13(a) to date
Sources
CISA/NSA/FBI Joint Advisory: Volt Typhoon
Microsoft: Volt Typhoon targets US critical infrastructure
US DOJ: U.S. Government Disrupts Botnet People's Republic of China Used to Conceal Hacking of Critical Infrastructure
Sources listed reflect publicly available materials used to construct this case entry. Inclusion does not imply endorsement. Where no URL is provided, the source may be found via its title and date.
Related Cases
APT1
2006 – disclosed February 2013; indictment May 2014 · China
APT1 is the foundational test case for indictment-as-signal in cyber statecraft. It demonstrates that the United States is willing to publicly name uniformed foreign military personnel, but that this willingness does not, on its own, translate into sanctions or any other coercive consequence. Read alongside Sandworm (indictment plus sanctions) and Salt Typhoon (sanctions on PRC contractor), it shows that the indictment-to-sanctions step is a discretionary political choice, not an automatic escalation.
Salt Typhoon
Access established earlier; disclosed September–December 2024 (note: investigation and disclosures ongoing as of May 2025) · China
Salt Typhoon is the temporal pivot of the matched-pair argument. It is structurally similar to Belgacom (a foreign state compromising another state's telecommunications backbone) but draws a sharply higher consequence, OFAC sanctions on a named contractor, because the perpetrator is positioned outside the Western attributing coalition. Read alongside Belgacom and OPM, it shows the consequence axis tracking political relationship rather than technical facts; read alongside Volt Typhoon, it shows that the relationship can move within a short time horizon (sanctions arrived for Salt Typhoon faster than for the parallel Volt Typhoon campaign).
Cloud Hopper
Active circa 2014 – publicly disclosed April 2017; indictment December 2018 · China
Cloud Hopper is the strongest pre-2024 data point on the indictment-without-sanctions cell at allied scale. It shows that even a broadly coordinated Five-Eyes-plus public-naming exercise against a PRC MSS contractor model did not, in 2018, escalate to OFAC sanctions. Read forward to Salt Typhoon (Jan 2025 OFAC sanctions on a comparable PRC contractor), it provides the time-series evidence that the consequence baseline for China-attributed espionage shifted in the 2024–2025 window, and that the shift was a political choice rather than a response to new technical facts.
Taiwan Telecom
2022 – 2023 (disclosed 2023) · China (assessed)
These intrusions highlight the emerging norm challenge of peacetime pre-positioning: states embedding access in adversary infrastructure for potential future use, blurring the line between espionage and preparation for attack.