If you sell software or services to utilities, telecoms, water or transport operators, you may be a target even if you are small. CISA's Volt Typhoon advisory notes that some victims are smaller organizations that provide critical services to larger ones. Your access to customers is the prize.
What the advisory says
The advisory names Communications, Energy, Transportation Systems and Water and Wastewater Systems as primary sectors. It says some victims are smaller organizations that provide critical services to larger organizations or to key locations. It also says the actors exploited known or zero-day flaws in internet-facing appliances and used valid credentials, and that they repeatedly re-target the same organizations.
Why suppliers are attractive
A supplier often has remote access into customer networks, support accounts, or credentials in a ticketing system. It may have fewer security staff than the customer. One compromise can open several doors, which is the same logic behind CISA's advice to limit persistent vendor connections after the Ukraine incident.
A baseline for software vendors
Edge devices. Patch VPNs, firewalls and routers first. They were the entry point in the advisory. Retire end-of-life devices.
Credentials. Do not store credentials on edge devices. Use phishing-resistant multi-factor authentication and separate admin from everyday accounts.
Customer access. Make customer connections operator-controlled and time-limited. Log every session. Avoid shared accounts.
Logging. Centralize logs and alert on log clearing.
Segmentation. Keep customer-facing support tooling away from your build and signing systems.
Incident plan. Decide in advance who tells customers and how fast. Contracts increasingly expect incident notification.
Questions customers will ask
Expect to be asked how you handle remote access, how you patch edge devices, and how you would notify them. Have written answers.
Safeguard's asset discovery and dependency scanning help you know what software you run and ship, which supports the vendor side of these answers.
For the attacker side of the story, see Living off the land: a hunting checklist.
An example access review
Take an hour and list every way a customer network can be reached from your side: VPNs, remote support tools, shared accounts, API keys and jump hosts. For each, note who can use it, whether it needs multi-factor authentication, whether sessions are logged, and whether it stays open. Close anything unowned and turn persistent connections into approved, time-limited ones.
Do the same in reverse for your own vendors. A supplier's supplier is part of the chain, and the advisory's point about smaller organizations applies at every link.
Finally, remember the advisory's remark that the actors repeatedly re-target the same organizations. A clean result this year is not a permanent result, so repeat the review on a schedule, such as twice a year and after any major change to your network or customer onboarding.
Quick check
Are only large utilities targeted?
No. The advisory says some victims are smaller organizations providing critical services to larger ones.
Sources
- CISA, NSA, FBI advisory AA24-038A on PRC state-sponsored actors
- CISA alert IR-ALERT-H-16-056-01 on the Ukraine power grid attack
Last reviewed: 19 October 2026.
