,Z 9VE/IGATORS PROBE :AT %UT D[N
,AM]ICAN AVIA;N ON ,FRI"D1 "O "N SITS 9
E BRIEF+ ROOM3 ,VOLT ,TYPHOON  ! ,*9ESE
/ATE-SPONSOR$ HACK+ GR\P ! ,,U GOV]N;T
SAYS HAS ALR BURR[$ 9TO ! C.TRY'S
CRITICAL 9FRA/RUCTURE & IS WAIT+4 ,"U/&+
:AT X IS1 & :Y XS ME?ODS >E SPECIFICALLY
DESIGN$ TO LOOK L AN A3ID5T1 IS ESS5TIAL
3TEXT = ! ,,FAA \TAGE  :AT"E XS CAUSE
TURNS \ TO BE4
,:AT ! ,,U GOV]N;T HAS 3FIRM$
,9 A JO9T CYB]SECUR;Y ADVISORY
"<,,AA#BD-#JCH;A1 ,FEBRU>Y #BJBD">1
,,CISA1 ! ,,NSA1 ! ,,FBI & 9T]NA;NAL
"PN]S MADE AN UNUSUALLY BLUNT ASSESS;T3
,P'S ,REPUBLIC ( ,*9A /ATE-SPONSOR$ CYB]
ACTORS >E SEEK+ TO PRE-POSI;N !MVS ON
,,X NET"WS = 4RUPTIVE OR DE/RUCTIVE
CYB]ATTACKS AG/ ,,U CRITICAL
9FRA/RUCTURE 9 ! EV5T ( A MAJOR CRISIS
OR 3FLICT4.<CITE3 ,,CISA_/,,NSA_/,,FBI
ET ;AL41 .<8,,PRC ,/ATE-,SPONSOR$
,ACTORS ,COMPROMISE & ,MA9TA9 ,P]SI/5T
,A3ESS TO ,U4,S4 ,CRITICAL
,9FRA/RUCTURE01 ,FEBRU>Y #BJBD.>.>
,! AG5CIES 3FIRM$ ,VOLT ,TYPHOON _H
COMPROMIS$ ,,X 5VIRON;TS AT MULTIPLE
CRITICAL 9FRA/RUCTURE ORGANIZA;NS 
PRIM>ILY 9 ,COMMUNICA;NS1 ,5]GY1
,TRANSPORTA;N ,SY/EMS1 & ,WAT] &
,WA/EWAT] SECTORS  9 ! 3T95TAL &
NON-3T95TAL ,UNIT$ ,/ATES & T]RITORIES1
9CLUD+ ,GUAM4
,:Y X'S N ESPIONAGE
,! ADVISORY'S %>PE/ F9D+ IS AB 9T5T3
,VOLT ,TYPHOON'S 8*OICE ( T>GETS &
PATT]N ( 2HAVIOR IS N 3SI/5T ) TRADI;NAL
CYB] ESPIONAGE OR 9TELLIG;E GA!R+
OP]A;NS40 ,! AG5CIES ASSESS ) HI< 3FID;E
T ! ACTORS >E PRE-POSI;N+ TO 5ABLE
LAT]AL MOVE;T ONTO OP]A;NAL TE*NOLOGY  !
SY/EMS T PHYSICALLY RUN 9FRA/RUCTURE 
8TO 4RUPT FUNC;NS40 ,9 S"EAL CASES A3ESS
_H BE5 MA9TA9$ = AT L1/ FIVE YE>S3
SIL5T1 PATI5T1 UNUS$  A LOAD$ W1PON KEPT
9 A HOL/]4.<CITE3 ,,CISA_/,,NSA_/,,FBI
ET ;AL41 .<8,,PRC ,/ATE-,SPONSOR$
,ACTORS ,COMPROMISE & ,MA9TA9 ,P]SI/5T
,A3ESS TO ,U4,S4 ,CRITICAL
,9FRA/RUCTURE01 ,FEBRU>Y #BJBD.>.>
,,CISA'S FRAM+ AT REL1SE 0 />K] /3 !
,,PRC 0 8POSI;N+ XF TO LAUN* DE/RUCTIVE
CYB]-ATTACKS T WD JEOP>DIZE ! PHYSICAL
SAFETY ( ,AM]ICANS & IMP$E MILIT>Y
R1DI;S 9 ! EV5T ( A MAJOR CRISIS OR
3FLICT40.<CITE3 ,,CISA1 .<8,U4,S4 &
,9T]NA;NAL ,"PN]S ,PUBLI% ,CYB]SECUR;Y
,ADVISORY ON ,,PRC ,/ATE-,SPONSOR$
,HACK+01 ,FEBRU>Y #BJBD.>.>
,LIV+ (F ! L&3 BUILT TO LOOK L A FAULT
,VOLT ,TYPHOON'S SIGNATURE TE*NIQUE IS
LIV+ (F ! L& "<,,LOTL">  9/1D ( 9/ALL+
DETECTABLE MALW>E1 ! ACTORS ABUSE
LEGITIMATE1 NATIVE TOOLS & PROCESSES ALR
ON ! VICTIM'S SY/EMS4 ,! E6ECT1 P]
,,CISA'S COMPANION GUID.E3 !Y 8BL5D 9 )
NORMAL SY/EM & NET"W ACTIVITIES1 AVOID
ID5TIFICA;N BY NET"W DEF5SES1 & LIMIT !
AM.T ( ACTIV;Y T IS CAPTUR$ 9 COMMON
LO7+ 3FIGURA;NS40.<CITE3 ,,CISA ET ;AL41
.<8,ID5TIFY+ & ,MITIGAT+ ,LIV+ ,(F ! ,L&
,TE*NIQUES0.>.>
,? IS ! TE*NIQUE'S /RATEGIC PAYLOAD3 AN
,,LOTL 9TRU.N T CAUSES A FAILURE
PRODUCES ALM NO?+ TO =5SICALLY 4T+UI% X
F AN H"O/ FAULT4 ,A CORRUPT$ R\TE1 A
POISON$ TABLE1 A W$G$ CIRCUIT  EA* IS
SIMULTANE\SLY 8AN \TAGE0 & 8AN ATTACK0
UNTIL "S"O C PROVE :4 ,T AMBIGU;Y IS N
9CID5TAL TO ,VOLT ,TYPHOON'S TRADECRAFT2
X IS ! TRADECRAFT4
,! 3NEC;N TO ,NOVEMB] #AC
,! ,,FAA \TAGE HIT ! TRANSPORTA;N &
COMMUNICA;NS LAY]S SIMULTANE\SLY  TWO (
! F\R SECTORS ,,CISA 3FIRM$ Z ,VOLT
,TYPHOON T>GETS  9 A MANN]
"<SIMULTANE\S1 NA;NWIDE1 CAUSE 9ITIALLY
UNLOCATABLE"> 3SI/5T ) :AT AN ACTIVAT$
PRE-POSI;N$ CAPABIL;Y MI<T PRODUCE4 ,T
IS 3TEXT1 N ATTRIBU;N3 ! ,,U GOV]N;T HAS
"ND NO ACTOR 9 ,FRI"D'S EV5T1 & !
MUNDANE-CAUSE CASE REMA9S /R;G4 ,! FULL
>GU;T T ! \TAGE CD 2 A DEMON/RA;N (
EXACTLY ? CAPABIL;Y  A 8CYB] ,PE>L
,H>BOR0 PRODUC+ /RATEGIC %OCK ) NO?+ TO
9DICT  IS MADE AT ,*9AS ,F/ ,CYB] ,PE>L
,H>BOR2 ! C.T]-CASE AT ,:Y ,! ,SKIES
,W5T ,D>K4
,:AT IS ALR E/ABLI%$1 9DEP5D5T ( ,FRI"D3
! CAPABIL;Y EXI/S1 ! A3ESS 0 3FIRM$1 !
T>GETS 9CLUD$ TRANSPORTA;N1 & ! ME?OD IS
5G9E]$ = D5IABIL;Y4 ,FRI"D IS ! F/
NA;NAL-SCALE \TAGE TO O3UR AF T 0
PUBLICLY "KN  : IS :Y ! "Q N[ EXI/S AT
ALL4
,SEE AL
"9 ,,FAA ,GR.DS ,ALL ,,U ,FLI<TS
,NOVEMB] #AC  HUB COV]AGE "9 ,*9AS ,F/
,CYB] ,PE>L ,H>BOR  ! ATTACK !SIS "9 ,:Y
,! ,SKIES ,W5T ,D>K  ! MUNDANE-CAUSE
CASE "9 ,J5S5 ,HUANG ,RESIGNS ,9SIDE !
,ALICE ,HUANG ,SC&AL "9 ,,ALB ,WIKI
,LAUN*ES ,NEWS