Volt Typhoon, a People’s Republic of China (PRC) state-sponsored cyber-espionage group, has stealthily infiltrated critical infrastructure networks within the United States, evading detection for an estimated five (5) years. This sophisticated group has primarily concentrated efforts on the communications, energy, transportation, and water/wastewater sectors, and is the same threat actor responsible for espionage attacks during summer 2023 in Guam and other militarily important parts of the U.S. The PRC hackers are especially known for their living off the land (LOTL) techniques and their attacks against critical infrastructure that are set up for follow-on attacks to cause physical harm and critical process disruptions. A concern of Volt Typhoon’s long-term presence in these networks is their presumed strategy to execute disruptive actions, potentially in response to military conflicts or geopolitical tensions with the U.S. The group often maintains their foothold in environments by exploiting network appliance vulnerabilities and using stolen credentials, allowing them to conduct extensive espionage and gather intelligence on Operational Technology (OT) systems. The FBI’s recent disruption of the KV-botnet malware, a tool used by Volt Typhoon to obscure their operations, signals a critical countermeasure against the group’s covert activities. Among heightened risks and increased concerns from top U.S officials, the FBI, NSA, and CISA, along with allied Five Eyes agencies, have released an advisory aimed at helping organizations identify and mitigate the risks posed by Volt Typhoon’s tactics.