IISS notes Volt Typhoon's targeting of US infrastructure signals disruptive intent beyond espionage

New analysis from the International Institute for Strategic Studies (IISS) highlights the enduring and far-reaching impact of Volt Typhoon , a China-linked APT (advanced persistent threat) group that first came to light in 2023 for infiltrating U.S. critical infrastructure networks. The group’s long shadow reflects its deep penetration of communications, energy, transportation, and government systems, apart from its persistence even after public remediation efforts, underscoring broader concerns state- cyber operations that embed in foundational digital infrastructure to gain strategic leverage and potential disruptive capabilities.

“Originally believed to be pursuing espionage objectives, Volt Typhoon’s activities are now widely regarded as an effort by the Chinese government to pre-position on critical infrastructure targets in preparation for disruption operations in the event of a military crisis with the US,” John Bruce, an associate fellow in the IISS Cyber Power and Future Conflict research programme, wrote in a recent Cyber Power Matrix post. “Three facts support this narrative. Firstly, the vast majority of the networks targeted by Volt Typhoon offered little foreign intelligence value to the Chinese government. Secondly, the threat actor focused on obtaining network diagrams and operating technology manuals that could inform future disruption operations. Thirdly, networks in Guam were likely targeted because US naval ports and air bases there would be critical to any American military response to a Chinese invasion or blockade of Taiwan.”

Bruce recognizes that by pursuing operationally bolder objectives and using tradecraft that allows it to hide in plain sight, Volt Typhoon has redrawn the boundary for acceptable state behaviour in cyberspace, extending states’ freedom of action in peacetime.

“By revealing that the protections offered by Norm 13(f) may be more limited than many states originally believed, China has raised fresh questions the value of the eleven voluntary norms as a mechanism to effectively regulate state behaviour in cyberspace,” he added. “Many members of the international community are likely to be uncomfortable with a norm that allows more technically advanced states to pre-position on CIIs in peacetime as part of their preparation for future armed conflict. This plays straight into China’s efforts to garner international support for a legally binding treaty restricting state use of offensive cyber operations, which Beijing presents as the only viable way to maintain security and stability in cyberspace.”

Norm 13(f) is a non-binding UN cyber norm stating that a state should not conduct or knowingly support cyber activity that intentionally damages or impairs critical infrastructure providing public services.

Bruce noted that the revelation places additional pressure on the West to develop strategies for anticipating and mitigating Volt Typhoon’s tradecraft while, at the same time, reassuring the international community that existing international law and the eleven voluntary norms offer a robust mechanism for regulating state behaviour in cyberspace.

As troubling as Volt Typhoon’s pre-positioning activity is, its use of ‘living off the land’ techniques is equally concerning. The group abuses legitimate network administration tools used for routine maintenance, system configuration, and privilege management, making its activity indistinguishable from that of authorized administrators. As these actions rely on trusted tools and interfaces, traditional security controls often fail to detect anything unusual. This allows the threat actor to maintain long-term access while blending malicious traffic into normal network patterns. Volt Typhoon further obscured its operations by leveraging nearby small-office and -office routers, firewalls, and VPN devices as botnets, causing external connections to appear as ordinary local traffic.

Recognizing that the attacker’s advantage is both asymmetric and enduring, Bruce noted that defenders must monitor every administrative tool on every system, every hour of every day, and analyse all of the traffic these tools generate to distinguish malicious commands from legitimate ones. “Moreover, successful threat actors will continue to treat these network tools as incubators for new tradecraft even as their existing operations are exposed and disrupted.”

The primary line of effort in defending forward is to disrupt or halt malicious cyber activity by adversaries wherever it arises, including through measures below the level of armed conflict.

Bruce highlighted the 2018 Cyber Strategy , which also outlines the U.S’s intent to employ offensive cyber capabilities to gain military advantage across the full spectrum of potential conflict.

“Against this backdrop, the Volt Typhoon campaign can be perceived as a direct response, demonstrating to the US and its Western partners that China’s capabilities and reach in cyberspace are on par with those of the West,” he added. “It sends a message that China’s adversaries should ‘think twice’ underestimating China’s capacity to compete in this strategic landscape. Furthermore, it creates apprehension in the West China’s potential to cause havoc by disrupting the operation of critical infrastructure, which may, in turn, diminish future political support for Western efforts to oppose Chinese military aggression, whether against Taiwan or to enforce sovereignty claims in the South China Sea.”

Bruce observed that there is an underlying logic for restricting the prohibition in Norm 13(f). “During an armed conflict, many CIIs will be legitimate military targets under international humanitarian law. The effectiveness of these military cyber operations is likely to depend on pre-conflict (i.e., peacetime) network reconnaissance, intelligence-gathering, and pre-positioning of relevant capabilities.”

In other words, interfering with critical infrastructure networks that could be legitimate military targets during a future armed conflict may not contravene Norm 13(f), provided those activities do not interfere with the ongoing provision of services to the public in peacetime.

Moreover, he added that such activities must be conducted in accordance with rigorous policy and legislative measures that ensure compliance with the acting state’s international legal obligations in peacetime and during a future armed conflict.