INCIDENT REPORT · CP-2024-002

Volt Typhoon pre-positioning in US critical infrastructure (CISA AA24-038A)

L3 · ELEVATEDCONFIRMED

CISA, NSA, FBI and international partners warned on 7 February 2024 that a PRC state-sponsored group had compromised US critical infrastructure IT networks. The agencies said the group was pre-positioning to enable future disruption.

Incident ID: CP-2024-002
Disclosure date: 07 FEB 2024
Detection date: Not publicly documented
Affected countries: United States
Plotted location: Washington, D.C., United States (National-level marker; the advisory covered multiple undisclosed US organizations)
Threat classification: Level 3 — ELEVATED
Classification rationale: Confirmed state compromises of multiple critical infrastructure sectors, though no disruption has been publicly documented.
Attack type: Infrastructure Compromise
Nature: Malicious activity
Attack vector: Living-off-the-land techniques after initial access to critical infrastructure IT environments
Sectors: Telecommunications, Energy, Transportation, Water
Critical infrastructure: Yes
Organizations affected: Undisclosed US critical infrastructure organizations (communications, energy, transportation, water and wastewater)
Operational consequences: The advisory said the actors had kept persistent access to some victim IT environments for at least five years. No disruptive attack was reported.
Estimated financial impact: No reliably documented figure
Attribution (as stated): Attributed by CISA, NSA, FBI and partner agencies to PRC state-sponsored actors known as Volt Typhoon

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

Volt Typhoon pre-positioning in US critical infrastructure (CISA AA24-038A)

L3 · ELEVATEDCONFIRMED

Incident ID

CP-2024-002

Disclosure date

07 FEB 2024

Detection date

Not publicly documented

Affected countries

United States

Plotted location

Washington, D.C., United States (National-level marker; the advisory covered multiple undisclosed US organizations)

Threat classification

Level 3 — ELEVATED

Classification rationale

Confirmed state compromises of multiple critical infrastructure sectors, though no disruption has been publicly documented.

Attack type

Infrastructure Compromise

Nature

Malicious activity

Attack vector

Living-off-the-land techniques after initial access to critical infrastructure IT environments

Sectors

Telecommunications, Energy, Transportation, Water

Critical infrastructure

Yes

Organizations affected

Undisclosed US critical infrastructure organizations (communications, energy, transportation, water and wastewater)

Operational consequences

The advisory said the actors had kept persistent access to some victim IT environments for at least five years. No disruptive attack was reported.

Estimated financial impact

No reliably documented figure

Attribution (as stated)

Attributed by CISA, NSA, FBI and partner agencies to PRC state-sponsored actors known as Volt Typhoon