Pre-positioning means gaining and keeping quiet access to a network now, so it can be used for disruption later. CISA, NSA and FBI assess with high confidence that PRC state-sponsored actors are doing this in US critical infrastructure IT networks. The advisory describes access, not an attack already launched.
What the advisory says
The agencies say the actors' choices and behavior are not consistent with traditional espionage. They mainly maintain persistence and avoid immediate exploitation. Some victims have had footholds for at least five years, and the actors repeatedly return to the same organizations.
The advisory names Communications, Energy, Transportation Systems and Water and Wastewater Systems as primary sectors. It also notes that some victims are smaller organizations that provide critical services to larger ones.
How they get in and stay in
Initial access came from exploiting known or zero-day vulnerabilities in internet-facing appliances such as routers, VPNs and firewalls. After that the actors obtained administrator credentials, sometimes from insecurely stored credentials on the appliances. They then moved with valid accounts and built-in tools such as PowerShell and wmic, a method often called living off the land. Because there is little malware, signature-based tools see little.
Why this is not a doomsday forecast
Two things stand out. First, the stated purpose is to have options during a major crisis or conflict. That is a risk statement about capability, and the advisory gives no date. Second, the tradecraft relies on ordinary weaknesses: unpatched edge devices, stored credentials, flat networks. Those are fixable.
What the agencies recommend
- Patch internet-facing systems, starting with frequently exploited appliances, and plan for end-of-life gear.
- Do not store credentials on edge devices. Use phishing-resistant multi-factor authentication and least privilege.
- Centralize logs and hunt for built-in tool abuse. The advisory points to Windows Event ID 1102 for log clearing.
- Deny IT to OT connections by default and route necessary traffic through monitored intermediaries.
- If you find a compromise, assume full domain compromise and reset credentials, including the krbtgt account twice.
Edge devices are where unknown flaws bite first. See Living off the land: a hunting checklist for the detection side.
Click through it at your own pace, or open it full screen.
Safeguard's zero-day discovery and asset discovery are aimed at the software and dependencies you run, which helps you know what is exposed. They do not replace patching network appliances or hunting for intruders.
How to explain this to your board or customers
Keep it to three sentences. Government agencies assess that a state-backed group has quiet access in some infrastructure networks. The goal described is to have options in a crisis, and nothing in the advisory says an attack is scheduled. Our job is to remove the easy routes in: patch edge devices, protect credentials and segment IT from OT.
If someone asks whether you are affected, the honest answer is that you check. Review edge device patch levels, look for log clearing events, and confirm that credentials are not stored on appliances. Those checks take days, not months, and they are the same ones the advisory recommends.
Quick check
Has Volt Typhoon launched a destructive attack?
The CISA advisory describes pre-positioning to enable disruption in a possible future crisis. It does not describe a disruptive attack as having occurred.
Is this only a big utility problem?
No. The advisory says some victims are smaller organizations that provide critical services to larger ones.
Sources
Last reviewed: 19 October 2026.
