Threadlinqs IntelligenceStart free

Threat actorChina / IranTracked since 2026-07

Volt Typhoon - G1017

Also known as:Volt TyphoonCyber Av3ngersCyberAv3ngers

As of 2026-10-06, Volt Typhoon - G1017 is a China / Iran-nexus threat actor tracked by Threadlinqs Intelligence across 2 threats spanning ics scada, threat intel. Also known as Volt Typhoon, Cyber Av3ngers, CyberAv3ngers. ATT&CK coverage spans 57 techniques across 17 tactics in 2 of 2 tracked threats. Most-observed techniques: T1078 (Valid Accounts), T1090.003 (Multi-hop Proxy), T1190 (Exploit Public-Facing Application).

Tracked threats
21 critical · 1 high
First seen
2026-07-27
Last seen
2026-10-06
ATT&CK techniques
57across 2 of 2 threats
Related CVEs
5Referenced by its activity
Attribution
China / IranNation or origin
Nation: China / Iran · 2 tracked threat(s) · Categories: ICS_SCADA, THREAT_INTEL

Activity timeline

Volt Typhoon - G1017 appears in 2 tracked threats between and ; the busiest month was 2026-07 with 1 report.

ATT&CK techniques observed

57 techniques observed across 2 of 2 tracked threats · Stealth (formerly Defense Evasion) (8), Execution (7), Resource Development (6), Initial Access (5), Collection (4), Credential Access (4)
  • T1078 Valid Accounts — Persistenceobserved in 2 of 2 tracked threats
  • T1090.003 Multi-hop Proxy — Command and Controlobserved in 2 of 2 tracked threats
  • T1190 Exploit Public-Facing Application — Initial Accessobserved in 2 of 2 tracked threats
  • T0893 Data from Local System — Collection (ICS)observed in 1 of 2 tracked threats
  • T1003.001 LSASS Memory — Credential Accessobserved in 1 of 2 tracked threats
  • T1003.003 NTDS — Credential Accessobserved in 1 of 2 tracked threats
  • T1016 System Network Configuration Discovery — Discoveryobserved in 1 of 2 tracked threats
  • T1020 Automated Exfiltration — Exfiltrationobserved in 1 of 2 tracked threats
  • T1021.001 Remote Desktop Protocol — Lateral Movementobserved in 1 of 2 tracked threats
  • T1027.002 Software Packing — Stealth (formerly Defense Evasion)observed in 1 of 2 tracked threats
  • T1027.013 Encrypted/Encoded File — Stealth (formerly Defense Evasion)observed in 1 of 2 tracked threats
  • T1036.005 Match Legitimate Resource Name or Location — Stealth (formerly Defense Evasion)observed in 1 of 2 tracked threats
  • T1041 Exfiltration Over C2 Channel — Exfiltrationobserved in 1 of 2 tracked threats
  • T1047 Windows Management Instrumentation — Executionobserved in 1 of 2 tracked threats
  • T1056.001 Keylogging — Collectionobserved in 1 of 2 tracked threats

Tracked threats

Related CVEs

5 CVEs referenced by tracked Volt Typhoon - G1017 activity