Volt_Typhoon__2024__Volt_Typhoon_targets_US_critical_infrastructure_with_living-off-the-land_techniques_Microsoft_Security_Blog.pdf

Microsoft Threat Intelligence describes Volt Typhoon, a state-sponsored actor targeting critical infrastructure in the United States since 2021. The group relies on living-off-the-land techniques and compromised edge devices to achieve credential access, discovery, persistence, and data staging, often routing traffic through SOHO devices and using proxies to conceal activity, with recommended mitigations and detections.