Volt Typhoon
MITRE G1017
Reports
8
First seen
Jun 8, 2023
Last seen
Jul 22, 2026
Motivation
Espionage
Relationships
Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.
Targeting
Sectors
Victim regions
×1×1
Canada×1
United Kingdom×1
United States×1
Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.
Top ATT&CK techniques
T1190 Exploit Public-Facing Application ×3T1021 Remote Services ×3T1018 Remote System Discovery ×3T1047 Windows Management Instrumentation ×2T1195 Supply Chain Compromise ×2T1570 Lateral Tool Transfer ×2T1219 Remote Access Software ×2T1046 Network Service Discovery ×2T1078 Valid Accounts ×2T1566 Phishing ×2T1071 Application Layer Protocol ×2T1087 Account Discovery ×2
Indicators
cve ×21
Indicator values are available on Pro and via the API.
Associated CVEs
Recent reports
High