April 17, 2025
It wasn’t an alarm blaring in a SOC. It wasn’t a red flashing screen demanding Bitcoin. It wasn’t even a report from a junior analyst catching a suspicious login.
Instead, the warning came in the form of a dull, bureaucratic advisory buried deep in a government report. It said, in sanitized language, what cybersecurity teams dread most:
They’re already inside.
For years, Chinese state-sponsored attackers have moved through the networks of the most critical industries—telecommunications, energy, defense, and government. Not to vandalize, not to ransom, but to wait.
And now, a new storm has taken shape.
This is the first in a comprehensive series that will explore the Typhoon family of Advanced Persistent Threat (APT) groups—Volt, Salt, and Flax—unpacking their tactics, operations, and what security teams need to do to stop them. Each of these groups has a different approach, but they share one truth: they are already embedded in critical systems around the world.
The Typhoon APT groups—Volt, Salt, and Flax—represent more than just groups of hackers. They are patient, methodical operators who specialize in silence. They are patient, building beachheads for the future. They don’t smash windows; they copy the keys. They don’t trip alarms; they move like employees.
These teams are quietly preparing for the future waves of cyberwarfare..
In late 2023 and again in early 2024, CISA and the FBI issued a chilling warning: Volt Typhoon had been inside U.S. critical infrastructure for months, moving undetected, preparing access for potential sabotage.
This was an ongoing operation, one that had been happening long before anyone noticed. It wasn’t an attempt or some theoretical breach.
Volt Typhoon is stealthily living off the land, blending into the everyday hum of IT operations. They rarely leave footprints or use flashy malware or ransomware. While SOC analysts focus on endpoints and logs, Volt Typhoon operates in the blind spots—hiding inside legitimate IT tools, moving like a ghost through the systems that keep entire countries running.
The Volt Typhoon APT group has developed a distinct profile for their methods and their targets.
If you’re thinking, “But we have endpoint security!”—great. Volt Typhoon doesn’t use endpoints. They live in the gaps, inside systems your SOC isn’t looking at, waiting for the day they’re told to act.
Cyber threats may come and go like seasonal viruses but Salt Typhoon is different. They don’t just break in—they set up a second home inside your network and settle in for the long haul.
Where Volt Typhoon is a ghost, Salt Typhoon is more like a parasite. Their goal is to gain unshakable, redundant footholds. They avoid the proverbial gates by building custom keys and paths, hiding them in as many places as they can.
They focus on long-term espionage, infrastructure persistence, and data exfiltration that no one notices until it’s too late.
The greater concer is that Salt Typhoon isn’t just inside your network. They’re inside the network of the companies you depend on.
Some attackers are disciplined, strategic, and targeted. Flax Typhoon is none of those things.
They are the opportunists—casting the widest net possible, breaching as many networks as they can, and figuring out what’s valuable later. Unlike Volt and Salt, who have specific missions, Flax Typhoon is here for everything.
Flax Typhoon isn’t here for one thing. They’re here for everything.
These groups aren’t just scouting. They aren’t experimenting.
They are preparing.
They are inside networks, inside supply chains, inside systems that cannot go down. And one day, when the signal comes, they will flip the switch.
A telecom blackout. A grid failure. A sudden, synchronized disruption that looks like a technical failure but isn’t.
The moment geopolitical tensions escalate, these infiltrations can be weaponized. A power grid outage. A military logistics failure. The foundation is already in place.
If you’re still thinking in terms of preventing breaches, you’re already too late. The focus now is on containment and control.
Prevention is ideal, but it only works if you assume you haven't already been breached. If Volt Typhoon has been inside telecom networks for months, how many other companies already have APTs quietly moving through their systems?
The Typhoon APT groups aren’t coming. They’re here. Now we have to make sure they can’t continue to move laterally and further dig in.
The question isn’t how to keep them out—but how to trap them before they strike.
Next up: Volt Typhoon—the patient infiltrator already inside U.S. infrastructure.
Try Keystrike in Your Environment for 30 Days
