Forecasting Typhoons: Volt Typhoon Next Steps in OT Disruption

Forecasting Typhoons: Volt Typhoon Next Steps in OT Disruption

Speakers: Joe Slowik, Director of Cyber Security Alerting Strategy, Dataminr

Conference: CYBERWARCON

YouTube: https://www.youtube.com/watch?v=t5P-o4jcwFI

Overview

In this compelling CYBERWARCON presentation, Joe Slowik, Director of Cyber Security Alerting Strategy at Dataminr, delves into the enigmatic activities of Volt Typhoon, a People's Republic of China (PRC)-linked threat actor. Slowik's research, spanning several years and drawing heavily on open-source intelligence, seeks to answer the critical "so what" question surrounding Volt Typhoon: what is the ultimate objective of their persistent intrusions into critical infrastructure? Despite widespread discussion and high-level concern from intelligence officials, there has been a notable absence of publicly known disruptive impacts linked to Volt Typhoon, making their long-term strategic intent a subject of intense speculation.

The talk provides an analytical framework for understanding potential cyber-physical impacts, dissecting various operational technology (OT) disruption types. Slowik meticulously examines Volt Typhoon's current operational posture, including their favored techniques and evolving targeting patterns. He then projects potential future actions, ranging from highly targeted outages aligned with military objectives to widespread, indiscriminate economic disruption. This article explores Slowik's insights, offering a detailed technical perspective on how Volt Typhoon might translate their extensive access into tangible cyber-physical effects and what this means for defenders.

Slowik's analysis is particularly pertinent given the geopolitical landscape, specifically the hypothesized link between Volt Typhoon's activities and a potential 2027 Taiwan scenario. This assessment, rooted in public comments from PRC leadership, suggests a readiness for a Taiwan invasion by 2027. In this context, Volt Typhoon is theorized to serve as a cyber component aimed at deterring or defeating the United States' ability to intervene on Taiwan's behalf. Understanding the adversary's potential next steps is crucial for bolstering critical infrastructure resilience against state-sponsored cyber threats.

Background

▶ Watch: Introduction: The 'So What' of Volt Typhoon (0:00)

Volt Typhoon stands as a cryptonym assigned to a sophisticated set of activity linked to the People's Republic of China, primarily targeting critical infrastructure entities in the United States, with recent intelligence also indicating similar activity against Australian critical infrastructure. While widely discussed, a defining characteristic of Volt Typhoon's observed operations is the lack of publicly known disruptive impacts. Unlike other state-sponsored attacks that have involved wipers or direct service disruption, Volt Typhoon's activities have thus far been characterized by intrusions, data gathering, and prepositioning within victim networks.

The group is often hypothesized to play a role in a 2027 Taiwan scenario, where the People's Liberation Army (PLA) aims to be ready for an invasion by that year. In such a scenario, Volt Typhoon's cyber operations would likely aim to deter or degrade the United States' capacity to intervene. Joe Slowik notes that Volt Typhoon, while clearly linked to PRC operations, is not attributed to a specific known group within the PRC's cyber actor ecosystem, such as a division of the Ministry of State Security. Instead, it is treated as a construct, although likely military-linked, possibly to the Strategic Support Force (SSF), though concrete public evidence remains elusive.

From a technical capabilities standpoint, Volt Typhoon is notorious for its adherence to living off the land (LOTL) techniques, leveraging legitimate system tools and functionalities to blend in and minimize detection. Alongside LOTL, they incorporate non-standard, but not necessarily custom, tooling, such as Fast Reverse Proxy, for enhanced operational flexibility. A hallmark of their infrastructure is the extensive use of proxy networks, often referred to as operational relay boxes (ORBs). These networks comprise compromised devices that serve as relays, obscuring the true origin of Volt Typhoon's traffic and making attribution and defense more challenging. While initial victimology was US-centric, recent comments suggest a broader focus across the greater Pacific region.

The significance of Volt Typhoon has been underscored by high-level US officials. Former FBI Director Christopher Ray described it as "the most critical thing that we're dealing with from a cyber perspective with respect to critical national infrastructure." Similarly, cybersecurity expert Alex Stamos characterized Volt Typhoon's prepositioning efforts as analogous to what would be required to "win World War II on a day one scenario." Despite these grave warnings, the absence of public "fire" – actual disruptive incidents – prompts a deeper inquiry into how Volt Typhoon's concerning operations could translate into tangible impacts on critical infrastructure. Slowik's talk aims to bridge this gap, asserting that Volt Typhoon's sustained interest in physical infrastructure, evidenced by targeting power authorities in Guam and West Coast port installations, strongly indicates preparation for future cyber-physical impact scenarios.

Key Findings

▶ Watch: Overview of OT disruption types: CIA triad (6:15)

Joe Slowik's analysis reveals several key findings regarding Volt Typhoon's strategic intent and operational trajectory. The central premise is that Volt Typhoon's extensive access development and information gathering are not ends in themselves but precursors to eventual cyber-physical impacts. Slowik categorizes these potential impacts into three primary types, drawing a parallel to the classic CIA triad: Confidentiality, Availability, and Integrity.

First, Confidentiality attacks involve the loss or exfiltration of information from an OT environment. This is often a necessary precondition for more sophisticated attacks. Volt Typhoon's data gathering, including specifics like hardware, software, and firmware versions, directly supports developing custom capabilities for future disruptive scenarios. Historically, campaigns like Berserk Bear exemplified threat actors gathering vast amounts of data from industrial environments without immediate disruptive intent, potentially for later use. Slowik emphasizes that to progress from an IT intrusion to an OT impact, actors require precise information about the target environment to craft effective payloads.

Second, Availability impacts are arguably the most common and critical form of OT disruption. These attacks aim to inhibit functionality, stop processes, wipe computers, or deploy ransomware, thereby disrupting industrial or critical infrastructure operations. Crucially, availability attacks need not be entirely OT-aware; they can target the underlying IT systems and dependencies that critical infrastructure relies upon, including legacy and unsupported versions of Windows and Linux. Examples include the deployment of wipers, similar to those seen in Ukraine or the Shamoon attacks, or even denial-of-service (DoS) activity that overwhelms communication pathways. The 2015 Ukraine power incident serves as a prime example of an availability disruption, causing temporary outages by opening breakers and damaging serial-to-Ethernet converters. While effective for temporary interruptions, availability attacks typically have limited long-term destructive potential, depending on recovery capabilities.

Third, Integrity attacks represent the most profound and destructive form of cyber-physical impact. These involve modifying fundamental aspects of an industrial process, degrading or removing safety and protection layers (e.g., safety instrumented systems, protective relays). The goal is to allow unintended or undesirable functionality to propagate, leading to physically destructive scenarios, potentially resulting in physical damage, environmental harm, or even loss of life. Integrity targeting is a necessary precondition for enabling meaningful cyber-physical impacts that extend beyond temporary disruption. While rare, Stuxnet stands as the most prominent successful example, manipulating process monitoring and control to achieve destructive outcomes. An attempted integrity attack was also observed in the Triton event of 2017, though it ultimately failed to achieve its destructive objective.

Slowik asserts that Volt Typhoon's activity is ongoing, despite some public claims of its defeat. While specific campaigns or tactics may shift, the underlying objective of the PRC to preposition within US critical infrastructure for future conflict remains. Recent observations indicate an expansion of Volt Typhoon's activities into sectors like oil and gas, alongside opportunistic targeting of entities such as small electric utility co-ops that hold little strategic value individually. This suggests a potential shift in Volt Typhoon's projected actions from highly specific outages—targeted disruptions aligned with military goals (e.g., Guam power, West Coast ports for a Taiwan scenario)—to a strategy of widespread chaos. This latter approach would involve indiscriminate and opportunistic targeting to acquire multiple points of presence simultaneously, aiming to maximize economic disruption across the US. Slowik assesses that this shift towards opportunistic targeting implies a lower barrier for entry in terms of capability development for Volt Typhoon, potentially focusing on widely deployable tools like wormable wipers rather than highly customized, site-specific payloads.

Technical Deep Dive

▶ Watch: Integrity attacks: Modifying safety for physical destruction (13:00)

The technical depth of Slowik's presentation lies in its detailed breakdown of how Volt Typhoon's observed behaviors could translate into the three distinct categories of OT disruption: Confidentiality, Availability, and Integrity. Each category demands specific technical prerequisites and offers varying levels of impact.

Confidentiality impacts are the foundational layer of sophisticated OT attacks. For Volt Typhoon, gaining initial access to the OT environment is the first hurdle, which can range from trivial (e.g., internet-exposed PLCs found via Shodan) to highly complex. Once inside, the objective is to identify and exfiltrate ground truth information. This includes granular details about specific assets, such as precise hardware, software, and firmware versions, configurations of data historians, or licensing servers. This data is critical for developing custom capabilities, as effective payloads for industrial control systems (ICS) environments are often highly specific to the target's unique setup. Slowik explicitly links this phase to the Cyber Kill Chain model, where the initial IT intrusion serves as a prerequisite for gathering the necessary intelligence to craft an effective OT payload. This process often involves traversing the Purdue Reference Architecture, moving from enterprise IT layers down into the operational technology zones.

Availability impacts represent the most common and often immediate form of disruption. Technically, these attacks can be broadly categorized into those that are OT-aware and those that target IT dependencies. OT-aware attacks might involve direct manipulation of industrial control processes, such as opening circuit breakers in an electrical grid, as demonstrated in the 2015 Ukraine power incident. In that event, attackers used remote access to open breakers and then deployed destructive payloads against serial-to-Ethernet converters to hinder recovery. More often, availability impacts arise from targeting the pervasive IT systems within or supporting OT environments. Many critical infrastructure operations rely on legacy, unsupported versions of Windows and Linux, making them vulnerable to standard IT attacks. Volt Typhoon could deploy wipers (like Shamoon or those seen in Ukraine) to erase data and render systems inoperable, or standard ransomware that, while not specifically designed for OT, can cripple the IT infrastructure necessary for safe and effective OT operation. Even denial-of-service (DoS) attacks, by overloading communication pathways, can prevent legitimate commands from reaching industrial assets, causing an availability impact. The Colonial Pipeline scenario is an example of an indirect availability impact, where a ransomware attack on IT systems led operators to preemptively shut down OT operations due to a lack of confidence in safe control.

The most technically challenging and destructive are Integrity impacts. These attacks require a deep understanding of the target process and the ability to modify or bypass the layers of safety and protection designed to prevent dangerous conditions. These layers include operator intervention, automated safety instrumented systems (SIS), protective relays (common in electrical environments), and physical engineering controls like blowout valves. An integrity attack aims to degrade or remove these safeguards, allowing a process to operate outside its safe parameters, leading to physical damage or destruction. Slowik cites Stuxnet as the singular successful public example of an integrity attack. Stuxnet not only manipulated process control (e.g., centrifuge speeds) but also targeted process monitoring, feeding operators false data to prevent detection of the destructive payload. The Triton event of 2017, while an attempt to target process safety, ultimately failed to achieve its destructive aims. For Volt Typhoon to achieve such an effect, they would need to develop highly site-specific tooling capable of understanding and manipulating proprietary industrial protocols and logic, a far more complex undertaking than deploying a generic wiper. Slowik notes that Volt Typhoon's current methods—reliance on LOTL, proxy networks, and non-custom tooling like Fast Reverse Proxy—are primarily geared towards initial access, persistence, and reconnaissance (confidentiality), which are necessary precursors but not direct integrity-impacting capabilities.

Slowik's assessment suggests that while Volt Typhoon continues to break into networks, gather information, and harvest credentials (the confidentiality phase), their strategic shift towards more widespread, opportunistic targeting implies a focus on capabilities that facilitate broad availability impacts. This could mean developing "wormable wiper functionality" that can be deployed simultaneously across numerous OT environments, rather than the highly specialized, integrity-focused tools required for targeted destruction.

Demo / Proof of Concept

▶ Watch: Assessing Volt Typhoon's likely shift to widespread disruption (24:20)

This talk was a detailed analysis of Volt Typhoon's strategic intent and potential operational evolution, rather than a demonstration of specific tools or proof-of-concept exploits. The speaker focused on synthesizing open-source intelligence and expert assessment to project future threat actor behavior and its implications for industrial control systems. No live demo or technical proof-of-concept was presented during the session.

Defensive Implications

▶ Watch: Persistent PRC interest and Volt Typhoon's evolution (26:00)

The persistent and evolving threat posed by Volt Typhoon necessitates a robust and adaptive defensive posture for critical infrastructure operators. Joe Slowik's analysis highlights several key defensive implications:

1. Anticipate Persistent PRC Interest: Defenders must operate under the assumption that the PRC will maintain a long-term strategic interest in gaining access to US critical infrastructure. While the specific tactics, techniques, and procedures (TTPs) associated with the "Volt Typhoon" cryptonym may shift or disappear in response to disclosures and defensive actions, the underlying strategic objective will not. This means continuous monitoring and adaptation are paramount.

1. Focus on Foundational Cybersecurity: Given Volt Typhoon's reliance on living off the land (LOTL) techniques, proxy networks (ORBs), and non-custom tooling like Fast Reverse Proxy, fundamental cybersecurity hygiene becomes even more critical. This includes rigorous patch management, strong authentication, network segmentation (especially between IT and OT environments), robust logging and monitoring, and endpoint detection and response (EDR) capabilities that can detect anomalous use of legitimate tools.

1. Bridge the IT/OT Divide: The potential for availability impacts stemming from attacks on IT systems (e.g., ransomware, wipers targeting Windows/Linux dependencies) underscores the need for a holistic security strategy that spans both IT and OT environments. Defenders must identify and secure IT systems that, if compromised, could indirectly impact OT operations, as seen in the Colonial Pipeline scenario.

1. Strengthen Availability and Recovery Capabilities: For scenarios involving widespread disruption, robust incident response and recovery plans are essential. This includes developing and regularly testing procedures for manual operations (as demonstrated in the 2015 Ukraine power incident), comprehensive backups, and rapid restoration capabilities to minimize the duration of outages. Organizations should prioritize resilience against disruptive attacks that aim to cause temporary but widespread service interruptions.

1. Protect Integrity Layers: While integrity attacks are harder to achieve, their potential for physical destruction demands stringent protection of safety and protection layers. This involves isolating safety instrumented systems (SIS), securing protective relays, and ensuring the integrity of process control logic. Regular audits of these systems, strict change management, and advanced anomaly detection within the OT network are crucial to prevent the degradation or bypass of safeguards. Network segmentation and unidirectional gateways can help prevent lateral movement from IT to critical OT safety systems.

1. Proactive Threat Intelligence and Information Sharing: The shift towards opportunistic targeting means that even smaller, seemingly non-strategic critical infrastructure entities are at risk. Defenders must leverage threat intelligence to understand evolving TTPs and targeting patterns. While some information may remain classified, responsible information sharing among critical infrastructure sectors and with government agencies is vital to build a comprehensive picture of the threat and collectively enhance defenses. Slowik's mention of non-public information highlights the ongoing challenge for the broader defensive community.

1. Evaluate Risk for Both Targeted and Widespread Scenarios: Organizations need to assess their vulnerabilities not only to highly targeted, militarily aligned attacks but also to widespread, indiscriminate disruption scenarios. This requires understanding critical dependencies and potential cascading effects across their operations and the broader infrastructure ecosystem.

Key Takeaways

• Volt Typhoon's Enigmatic Threat: Volt Typhoon is a PRC-linked threat actor persistently targeting critical infrastructure, likely preparing for future cyber-physical operations, yet there are no publicly known disruptive impacts to date.
• Three Pillars of OT Disruption: Cyber-physical impacts can be categorized into Confidentiality (information gathering, a prerequisite for advanced attacks), Availability (service disruption via IT or OT systems, common), and Integrity (physical destruction by bypassing safety measures, rare but devastating).
• Integrity Attacks are the Apex of Difficulty: Physically destructive integrity attacks, like Stuxnet, are the hardest to achieve and scale, requiring deep process knowledge and the ability to bypass multiple safety layers, making them unlikely for widespread, opportunistic campaigns.
• Shifting Strategic Intent: Evidence suggests Volt Typhoon's strategy may be evolving from highly targeted operations (e.g., Guam power grids) to more widespread, opportunistic targeting across diverse critical infrastructure, aiming for broad economic disruption rather than specific military objectives.
• Persistent PRC Pressure: The underlying strategic imperative for the PRC to gain long-term access to US critical infrastructure will persist, regardless of how Volt Typhoon's specific TTPs evolve or if the cryptonym itself changes.
• Defensive Imperatives: Defenders must prioritize foundational cybersecurity (LOTL defense, strong network segmentation), prepare for both targeted and widespread availability impacts, rigorously protect OT safety layers against integrity attacks, and actively engage in threat intelligence to adapt to evolving TTPs.

About the Speaker(s)

Joe Slowik is the Director of Cyber Security Alerting Strategy at Dataminr, a role that leverages his extensive experience in cybersecurity research and analysis. Throughout his career, which has spanned several companies, Slowik has focused on understanding complex threat actor behaviors and their implications for critical infrastructure. His presentation at CYBERWARCON, "Forecasting Typhoons: Volt Typhoon Next Steps in OT Disruption," is based on several years of dedicated research into the activities and potential future actions of the Volt Typhoon threat actor.