Volt Typhoon is a China-based state-sponsored hacking group that targeted U.S. critical infrastructure to pre-position for disruptive attacks.
This FAQ explains who was notified, what you can do if affected, and how to reduce your risk. According to the Microsoft Security Blog, the group used living-off-the-land methods that abuse valid logins and built-in network tools Microsoft's May 2023 analysis. That stealthy approach shaped both the FBI response and the protection steps below.
Table of Contents
- What was Volt Typhoon trying to do?
- Why were home and small-office routers involved?
- Would I have been notified?
- How do I protect a home or small-business network now?
- What should infrastructure and business leaders do?
What was Volt Typhoon trying to do?
Volt Typhoon sought long-term footholds inside U.S. networks rather than quick theft. CISA and FBI partners assessed the group held access in some victim systems for at least five years to prepare for disruptive or destructive attacks CISA's February 2024 advisory. Affected sectors included communications, energy, transportation systems, and water and wastewater systems.
Targets covered the continental and non-continental U.S. and territories, including Guam. For most residents, the direct contact point was not the utility network. It was the small-office router hijacked to hide the attackers' origin.
Why were home and small-office routers involved?
The attackers used the KV Botnet, malware installed on vulnerable routers, to route attacks through normal-looking U.S. addresses. The hijacked devices were mostly end-of-life Cisco RV320 and RV325 and NETGEAR models.
Those models often stay in service long after security updates stop. Once compromised, they can pass attacker traffic without obvious signs for owners. The FBI ran a court-authorized operation in December 2023 that removed the malware from hundreds of U.S. routers and cut contact with attacker controls, as announced by the Justice Department the Justice Department's January 2024 announcement.
Would I have been notified?
Owners of disinfected routers or their internet providers were notified after the FBI's remote remediation broke botnet connectivity. Notice came after action, not before, to avoid tipping off the operators. Check your ISP email, letters, and account alerts from early 2024 if you used an affected Cisco or NETGEAR router.
If you replaced the router, check messages tied to the account active at that time. No notice does not prove you were untouched. Living-off-the-land activity blends with normal logins, so providers and agencies focused notice on devices confirmed in the botnet.
How do I protect a home or small-business network now?
Replace end-of-life routers that no longer receive firmware updates. Install current firmware, change default passwords, turn on automatic updates, and enable multi-factor authentication on router, email, and ISP accounts.
CISA urges logging, multi-factor authentication, least privilege, and replacement of end-of-life devices because valid-account abuse evades signature detection. Least privilege means each user and device gets only the access needed to work.
- Replace end-of-life Cisco, NETGEAR, or other unsupported routers
- Update firmware, disable remote administration, and use a strong unique admin password
- Turn on multi-factor authentication and limit administrator accounts
- Reboot and recheck logs after fixes, then report suspected compromise to CISA or the FBI
What should infrastructure and business leaders do?
Treat cyber risk as business risk, with funded logging, patching, and access control. Run tabletop exercises for loss of communications or control systems, and define who calls CISA and the FBI. Keep logs long enough to hunt slow intrusions across months, not days.
Review vendor remote access, service accounts, and old edge devices that may lack support. Report incidents quickly to CISA or the FBI, and preserve logs and device images before rebuilding. Fast reporting helps investigators link activity and warn other operators.
You Might Also Like
- Medusa Ransomware FAQ: Notifications, Rights, and Protection
- Legal Aid Agency Cybersecurity Incident: Does It Mean a Solicitor’s Own System Was Hacked?
- Legal Aid Agency Data Breach: Why You Should Not Search for Copies of Leaked Case Files