Dragos Says Volt Typhoon Continued Targeting U.S. Utilities Through 2025
Summary
Dragos says Volt Typhoon remained active in U.S. utilities through 2025, embedding in OT networks; it warns some compromises, especially at smaller water utilities, may never be found. SYLVANITE reportedly provides initial access.
Key points
- Dragos says Volt Typhoon continued targeting U.S. utilities through 2025 and seeking long-term access to operational technology networks.
- Dragos CEO Rob Lee warned that some compromised sites in the U.S. and NATO countries may never be discovered; smaller water utilities may lack the capacity to identify and remove intruders.
- U.S. authorities say Volt Typhoon seeks to pre-position access to OT networks for potentially disruptive attacks during a U.S. military mobilization.
- Dragos describes SYLVANITE as a group that gains initial access to utility and other industrial organizations before handing access to Volt Typhoon.
- Dragos attributed campaigns involving Ivanti and Trimble Cityworks vulnerabilities to Volt Typhoon and SYLVANITE; cybersecurity firms later confirmed Chinese hackers used the Cityworks vulnerability to breach multiple local governments.
- Dragos says attackers collected GIS, sensor, and operational data, which could help plan disruptive attacks on electric and water infrastructure.
- China denies involvement, and U.S. officials say reported totals of Volt Typhoon victims are likely underestimates.
Article Details
- Event Type
- Dragos reported continued Volt Typhoon activity against U.S. utilities through 2025 and described SYLVANITE gaining initial access before handing compromises to Volt Typhoon.
- Impact
- The reported compromises involve persistent access to operational technology networks and the collection or exfiltration of GIS, sensor, and operational data that could support disruptive attacks on electric and water infrastructure. Dragos warned that some compromised sites, particularly smaller water utilities, may never be discovered or remediated. The article also reports breaches of local governments and utility networks involving vulnerabilities in Ivanti and Trimble Cityworks.
People
Threat Actors
SYLVANITEDragos says SYLVANITE gained initial access to organizations, including utilities, and handed compromises to Volt Typhoon for further activity. Dragos reported its targeting across multiple regions and industries.Volt TyphoonDragos reported that Volt Typhoon continued attacking U.S. utilities through 2025, embedding in operational technology networks, and receiving access from SYLVANITE. U.S. authorities describe its goal as pre-positioning for potentially disruptive attacks; China has denied involvement.
Vendors
DragosDragos reports that Chinese-linked threat actor Volt Typhoon continued compromising U.S.IvantiThreat actors exploited vulnerabilities in Ivanti and Trimble Cityworks to breach local governments and utility networks.TrimbleThreat actors exploited vulnerabilities in Ivanti and Trimble Cityworks to breach local governments and utility networks.
Products
Countries
ChinaChina has denied any involvement in the Volt Typhoon compromises but evidence of Volt Typhoon hackers was found hidden in U.S.PhilippinesThat group, which Dragos calls SYLVANITE, was seen targeting operational technology systems across North America, Europe, South Korea, Guam, the Philippines and Saudi Arabia.Saudi ArabiaThat group, which Dragos calls SYLVANITE, was seen targeting operational technology systems across North America, Europe, South Korea, Guam, the Philippines and Saudi Arabia.South KoreaThat group, which Dragos calls SYLVANITE, was seen targeting operational technology systems across North America, Europe, South Korea, Guam, the Philippines and Saudi Arabia.United StatesDragos reports that Chinese-linked threat actor Volt Typhoon continued compromising U.S.
Industries
ManufacturingThe group gained initial access to organizations in the oil and gas, water, power generation, transmission and manufacturing industries.Oil and gasThe group gained initial access to organizations in the oil and gas, water, power generation, transmission and manufacturing industries.Power GenerationThe group gained initial access to organizations in the oil and gas, water, power generation, transmission and manufacturing industries.transmissionThe group gained initial access to organizations in the oil and gas, water, power generation, transmission and manufacturing industries.waterResearchers warn many compromises—especially in smaller water-sector utilities—may never be found, with initial access groups like SYLVANITE handing breaches to Volt Typhoon.