Volt Typhoon Explained

As investigators probe what shut down American aviation on Friday, one name sits in every briefing room: Volt Typhoon — the Chinese state-sponsored hacking group the US government says has already burrowed into the country's critical infrastructure and is waiting. Understanding what it is, and why its methods are specifically designed to look like an accident, is essential context for the FAA outage — whatever its cause turns out to be.

What the US government has confirmed

In a joint cybersecurity advisory (AA24-038a, February 2024), CISA, the NSA, the FBI and international partners made an unusually blunt assessment: People's Republic of China state-sponsored cyber actors are seeking to pre-position themselves on IT networks for disruptive or destructive cyberattacks against US critical infrastructure in the event of a major crisis or conflict.^[1]

The agencies confirmed Volt Typhoon had compromised IT environments at multiple critical infrastructure organizations — primarily in Communications, Energy, Transportation Systems, and Water and Wastewater sectors — in the continental and non-continental United States and territories, including Guam.

Why it's not espionage

The advisory's sharpest finding is about intent: Volt Typhoon's "choice of targets and pattern of behavior is not consistent with traditional cyber espionage or intelligence gathering operations." The agencies assess with high confidence that the actors are pre-positioning to enable lateral movement onto operational technology — the systems that physically run infrastructure — "to disrupt functions." In several cases access had been maintained for at least five years: silent, patient, unused — a loaded weapon kept in a holster.^[1]

CISA's framing at release was starker still: the PRC was "positioning itself to launch destructive cyber-attacks that would jeopardize the physical safety of Americans and impede military readiness in the event of a major crisis or conflict."^[2]

Living off the land: built to look like a fault

Volt Typhoon's signature technique is living off the land (LOTL) — instead of installing detectable malware, the actors abuse legitimate, native tools and processes already on the victim's systems. The effect, per CISA's companion guidance: they "blend in with normal system and network activities, avoid identification by network defenses, and limit the amount of activity that is captured in common logging configurations."^[3]

This is the technique's strategic payload: an LOTL intrusion that causes a failure produces almost nothing to forensically distinguish it from an honest fault. A corrupted route, a poisoned table, a wedged circuit — each is simultaneously "an outage" and "an attack" until someone can prove which. That ambiguity is not incidental to Volt Typhoon's tradecraft; it is the tradecraft.

The connection to November 13

The FAA outage hit the transportation and communications layers simultaneously — two of the four sectors CISA confirmed as Volt Typhoon targets — in a manner (simultaneous, nationwide, cause initially unlocatable) consistent with what an activated pre-positioned capability might produce. That is context, not attribution: the US government has named no actor in Friday's event, and the mundane-cause case remains strong. The full argument that the outage could be a demonstration of exactly this capability — a "cyber Pearl Harbor" producing strategic shock with nothing to indict — is made at Chinas First Cyber Pearl Harbor; the counter-case at Why The Skies Went Dark.

What is already established, independent of Friday: the capability exists, the access was confirmed, the targets included transportation, and the method is engineered for deniability. Friday is the first national-scale outage to occur after that was publicly known — which is why the question now exists at all.

See also

• FAA Grounds All US Flights November 13 — hub coverage
• Chinas First Cyber Pearl Harbor — the attack thesis
• Why The Skies Went Dark — the mundane-cause case
• Jensen Huang Resigns Inside the Alice Huang Scandal
• ALB Wiki Launches News