Volt Typhoon Threat Report

This MD-ISAC threat bulletin documents Volt Typhoon, a PRC-linked APT targeting U.S. federal and critical infrastructure sectors (communications, energy, transportation, water) by exploiting end-of-life SOHO routers—notably Cisco RV320/RV325 (CVE-2019-1652/1653)—and using living-off-the-land techniques and botnets; the report lists TTP mappings, extensive IOCs (hashes and IPs), cites FBI/CISA activity including disruption of the KV‑Botnet, and provides mitigation and incident response recommendations.