Agencies said a state actor pre-positioned inside US utilities

What happened

On 7 February 2024, CISA, the FBI, the NSA and partner agencies published a joint cybersecurity advisory, AA24-038A, stating that they assess with high confidence that a state-sponsored actor tracked as Volt Typhoon has been pre-positioning itself on the information technology networks of organizations in the communications, energy, transportation systems and water and wastewater sectors. The advisory describes the group's approach as living off the land: using legitimate, already-installed administrative tools rather than deploying custom malware, specifically to blend into normal network activity and evade detection based on known malicious files.

This built on an earlier joint advisory, AA23-144A, published 24 May 2023, which had first documented Volt Typhoon's use of built-in Windows utilities such as wmic, ntdsutil, netsh and PowerShell against critical infrastructure targets. The 2024 advisory states it reflects investigative findings current through February 2024 and represents an update to the guidance issued in 2023, describing continued observation of the same actor's tradecraft rather than a single new event.

Confidence and limits

The advisory is explicit that its attribution rests on an assessment made with high confidence by the authoring agencies rather than a court finding or company confirmation, and this article preserves that distinction: high confidence describes the agencies' own analytic judgment, not certainty. The advisory documents pre-positioning and access, and it does not claim, and this article does not assert, that Volt Typhoon caused any outage or disruption to the sectors named; the stated concern is the potential for disruptive effects during a future crisis.

Why it mattered

Living-off-the-land activity is difficult to detect using tools built around known malware signatures, since the actions involved, an administrator running PowerShell or resetting network settings, look identical to routine system administration until examined in context. Positioning inside critical infrastructure IT networks without immediately causing damage matters because it preserves the option to cause damage later, at a time of the actor's choosing, which is a materially different risk profile than an attacker who monetizes access immediately through ransomware or fraud.

Defensive takeaway

Build detection around behavioral baselines and unusual use of administrative tools rather than relying solely on signature-based detection, and apply the credential-reset and logging recommendations in the advisory even absent any sign of active compromise.

• Would our monitoring flag an administrator account using PowerShell or netsh in a way that deviates from that account's normal pattern?
• Have we planned for the possibility that an intrusion in our environment is intended for future disruption rather than immediate financial gain?
• Do we retain and centralize logs long enough, and completely enough, to reconstruct living-off-the-land activity if it is later discovered?

The Volt Typhoon advisories describe a form of access that succeeds precisely by avoiding anything that looks like an attack, which is why detecting it depends on knowing what normal administrative activity looks like well enough to notice when it is not quite normal.