Nothing Looks Wrong: Living-Off-the-Land Tradecraft

Volt Typhoon held access to US critical infrastructure for at least five years without dropping malware. The TTPs are documented by CISA, NSA, FBI and Microsoft Threat Intelligence: native admin tools, valid sessions, signed binaries with sideloaded components. Nothing they did ever looked wrong.

This 25-minute lab walks the Volt Typhoon anatomy phase by phase, then puts three other campaigns next to it: Salt Typhoon’s telco intrusions, Flax Typhoon’s edge-device persistence, and the BRICKSTORM activity Mandiant tracked in 2024 and 2025. Each one exploits the same gap from a different angle.

You will leave with the behavior signals that connect all four campaigns, the categories of telemetry your tools cannot produce alone, and three changes worth shipping on Monday.