{
 "Event": {
  "uuid": "5f9dcf4f-58d3-5a6c-a295-e75e096c521f",
  "info": "Volt Typhoon Pre-Positioning in Critical Infrastructure",
  "date": "2023-06-01",
  "threat_level_id": "1",
  "analysis": "2",
  "distribution": "3",
  "published": false,
  "Orgc": {
   "name": "SecurityStudies.info"
  },
  "Tag": [
   {
    "name": "tlp:clear"
   },
   {
    "name": "securitystudies:status=\"curated\""
   },
   {
    "name": "securitystudies:type=\"apt\""
   },
   {
    "name": "misp-galaxy:threat-actor=\"Volt Typhoon\""
   },
   {
    "name": "misp-galaxy:country=\"united states\""
   },
   {
    "name": "misp-galaxy:country=\"japan\""
   },
   {
    "name": "misp-galaxy:country=\"australia\""
   },
   {
    "name": "misp-galaxy:country=\"guam\""
   },
   {
    "name": "misp-galaxy:country=\"philippines\""
   },
   {
    "name": "misp-galaxy:sector=\"Energy\""
   },
   {
    "name": "misp-galaxy:sector=\"Water & Wastewater\""
   },
   {
    "name": "misp-galaxy:sector=\"Transportation\""
   },
   {
    "name": "misp-galaxy:sector=\"Communications\""
   },
   {
    "name": "misp-galaxy:sector=\"Defense Industrial Base\""
   }
  ],
  "Attribute": [
   {
    "type": "link",
    "category": "External analysis",
    "value": "https://securitystudies.info/cyber/incidents/volt-typhoon-pre-positioning-in-critical-infrastructure/",
    "comment": "SecurityStudies.info entry",
    "to_ids": false
   },
   {
    "type": "link",
    "category": "External analysis",
    "value": {
     "title": "CISA Advisory — Volt Typhoon",
     "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a"
    },
    "comment": "source",
    "to_ids": false
   },
   {
    "type": "link",
    "category": "External analysis",
    "value": {
     "title": "Five Eyes Joint Advisory",
     "url": "https://www.cisa.gov/news-events/alerts/2024/02/07/cisa-and-partners-release-advisory-prc-state-sponsored-actors"
    },
    "comment": "source",
    "to_ids": false
   },
   {
    "type": "text",
    "category": "Other",
    "value": "Volt Typhoon (also Vanguard Panda) continues pre-positioning operations inside US, Japanese, and Australian critical infrastructure networks. Using living-off-the-land techniques and compromised SOHO routers as relay nodes, the group has maintained persistent access to water utilities, energy grids, transportation, and communications infrastructure across the Indo-Pacific. May 2026 CISA guidance highlights new detections in Guam-based military support infrastructure.",
    "comment": "summary",
    "to_ids": false
   }
  ]
 }
}