Chinese hackers associated with the Volt Typhoon campaign infiltrated the systems of the Littleton Electric Light & Water Department in Massachusetts for nearly a year. This attack was part of a larger Chinese government effort to embed hackers within U.S. critical infrastructure, potentially for destructive actions during a conflict. The breach was discovered just before Thanksgiving in 2023, prompted by an FBI alert to the utility’s assistant general manager, David Ketchen. FBI and CISA representatives quickly responded to the situation. Investigation revealed Volt Typhoon’s presence since February 2023, with evidence of lateral movement and data exfiltration. However, no customer-sensitive data was compromised, and the utility managed to alter its network architecture to mitigate further threats. The attack underscores the adversary’s intent to maintain prolonged access and exfiltrate data concerning OT operating procedures and spatial layouts, crucial for potential destructive attacks. While China denies involvement, CISA and the FBI have repeatedly warned about Volt Typhoon’s activities aimed at positioning themselves within IT networks for disruptive attacks against U.S. infrastructure amid tensions with Taiwan. Evidence of Volt Typhoon’s presence has previously been found in U.S. infrastructure in Guam and near military bases, likely to impede mobilization efforts. The number of victims remains unknown, with U.S. officials suggesting estimates are underestimated. The Volt Typhoon campaign has prompted U.S. governmental efforts to strengthen infrastructure security. Researchers have emphasized tracking Volt Typhoon as a critical threat group, noting their theft of geographic data, network diagrams, and operational instructions from victims. They typically exploit vulnerabilities in internet-facing VPNs or firewalls for initial access. CTIX analysts advise utilities to enhance patch management and system integrity.