An emerging Chinese threat organization has reportedly been targeting United States critical infrastructure in their current operations. The group is tracked under the codename Volt Typhoon and has been actively targeting critical infrastructure companies within the government, communications, transportation, maritime, information technology, education, and communications sectors. During these attacks, Volt Typhoon actors would often compromise their victims through vulnerable public-facing FortiGuard devices, giving direct access into their network. Attackers will often attempt to gain privileged access in Active Directory by harvesting credentials stored in the Local Security Authority Subsystem Service (LSASS) process memory space. In addition to privilege escalation, threat actors also deployed a command line utility to install new domain controllers, allowing for multiple authentication attempts on network-connected devices. As the final step, Volt Typhoon actors establish a command-and-control (C2) connection back to their infrastructure to allow for the execution of remote commands and remote access to the victims’ network(s). Additional tactics utilized by the group include capitalizing on local resources of compromised infrastructure, or ‘living-off-the-land’ activities through the system on-screen keyboard and LOLBin binaries to transfer additional payloads from the C2 server to victim networks. CTIX continues to monitor threat actor activity worldwide and will provide additional updates accordingly.