Volt Typhoon — Adversary Emulation Playbook

Tier-3 PRC actor specializing in undetected long-dwell pre-positioning inside critical infrastructure. The defining trait is living-off-the-land only: almost no malware, built-in OS tooling for everything, credentials harvested from edge devices, log tampering, and egress proxied through compromised SOHO routers. The deliverable is proving quiet, persistent access — not data theft. Authorized red-team emulation only; runs under the RoE.

When to emulate Volt Typhoon

• The client wants to test detection of stealthy, malware-free intrusions and dwell time — can the SOC catch an actor that only uses built-ins?
• Communications, energy, water, transportation, or other critical-infrastructure targets (see the industry → actor map in ../../references/apt-groups.md).
• Topical: CISA BOD 26-02 (Feb 2026) prioritizes end-of-support edge-device risk — exactly Volt Typhoon's initial-access surface.

ThreatProfile seed (plan/threat-profile.json)

{
  "engagement_name": "<fill>",
  "actor_name": "Volt Typhoon-like (Vanguard Panda)",
  "actor_aliases": ["Vanguard Panda", "BRONZE SILHOUETTE", "Insidious Taurus", "DEV-0391", "Voltzite"],
  "group_id": "G1017",
  "tier": "tier-3",
  "sophistication": "nation-state",
  "motivation": "espionage",
  "initial_access": ["T1190", "T1133", "T1078"],
  "key_ttps": ["T1059.001", "T1059.003", "T1003.003", "T1552.001", "T1018", "T1021.001", "T1070.001", "T1090.003"],
  "tools": ["Native LOLBins (netsh, wmic, ntdsutil, vssadmin, reg)", "Impacket", "FRP / Fast Reverse Proxy", "NetExec (low-noise modules)"],
  "infrastructure": ["Compromised edge appliance foothold", "Multi-hop proxy via engagement SOHO hop", "No persistent malware - valid accounts only"],
  "recent_cti_delta": "CISA AA24-038A: multi-year dwell in US critical infrastructure; KV-botnet of compromised SOHO routers for proxying; pre-positioning toward OT; edge-device (Fortinet/Ivanti/Citrix/router) initial access.",
  "confidence": "probable"
}

Kill-chain emulation

Defense evasion is the headline behavior: T1070.001 (clear Windows event logs) and strict LOTL are enforced by the shared defense-evasion / opsec skills auto-injected into every operational agent.

CONOPS kill_chain (copy into conops.json)

1. recon — edge-appliance + network identification (1).
2. initial-access — edge exploit / device-cred reuse (2-3).
3. post-exploit — LOTL discovery, NTDS/cred theft, RDP lateral, pre-positioning + log cleanup (5-8).
4. c2 — FRP/Sliver multi-hop via SOHO proxy hop (4).
5. exfiltration — minimal/none; pre-positioning only. Add an espionage subset only if explicitly in scope.

OPSEC & signature fidelity

• LOTL or it isn't Volt Typhoon. Built-ins only: netsh, wmic, ntdsutil, vssadmin, reg, dnscmd, PowerShell. No port scanners, no Cobalt/Metasploit, no dropped binaries.
• Proxy egress through a residential/SOHO hop, never a datacenter IP.
• Clear logs after each action; the whole exercise tests whether the SOC can detect a malware-free, log-minimized intruder.
• Maximum patience. Pace actions over days; success metric is dwell time before detection.

RoE / safety gates

• The objective is access, not impact — default to no destructive or OT-write action.
• Edge-device exploitation can brick appliances; require device-write authorization and confirm a config backup exists before exploiting.
• Add an EMERGENCY abort trigger: "any action against OT/safety systems" — pre-positioning stops at the IT/OT boundary unless OT is explicitly authorized (then see the sandworm playbook's ICS gates).

Deconfliction

• Record the engagement proxy hop(s), edge-device foothold, and NTDS-dump artifact in deconfliction.json + cleanup.json.
• Brief the network team that valid-account RDP + NTDS access are expected; the value is measuring time-to-detect, so keep the deconfliction list tight and SOC-blind where lawful.

Fidelity notes (deviations)

• No real SOHO botnet. Emulate multi-hop proxying with a single engagement-owned hop + FRP/Sliver.
• LOTL tradecraft is reproduced faithfully and safely — this is the rare actor whose real TTPs are also the safe-to-emulate ones.
• Pre-positioning ends at documented footholds; the deliverable proves dwell + reachability, never live disruption.