China MSS-affiliated threat actor pre-positioning inside Texas energy, water, and pipeline OT networks since mid-2022. Not financial crime — sabotage preparation. Living-off-the-land (LOLBins) tradecraft evades every signature-based detection tool your team is running today.
Published: June 15, 2026 · Sources: CISA AA24-038B, FBI AA25-016, NSA Cybersecurity Report 2025, IBM X-Force Threat Intelligence Index 2026
This is not a ransomware threat. Volt Typhoon is not encrypting files for ransom — it is establishing persistent, undetected access to operational technology (OT) networks that control physical infrastructure. The objective is sabotage, not disruption. Texas grid operators, water utilities, and midstream pipeline companies are in their targeting set. If your network touches any of these sectors, assume you are already in their environmental footprint.
Volt Typhoon uses living-off-the-land binaries (LOLBins) and legitimate credentials to blend into normal network traffic. Standard EDR, AV, and SIEM rules designed for ransomware signatures will not flag this activity. Below are the confirmed techniques from CISA AA24-038B.
| Technique | ID | Description | TX Exposure | Severity |
|---|---|---|---|---|
| Valid Accounts | T1078 | Uses harvested or purchased credentials for VPN, firewall, and O365 logins to establish initial access. No malware to detect. | All sectors — especially VPN appliances at utility IT/OT boundary | HIGH |
| Exploit Public-Facing Application | T1190 | Leverages unpatched VPN gateways (CVE-2018-13379 FortiGate, Pulse Connect Secure) and edge devices to gain initial foothold. | IT/OT boundary devices, remote access infrastructure | HIGH |
| Native Binary Proxy Execution | T1218 | Uses wmic.exe, mshta.exe, certutil.exe, bitsadmin.exe — all Windows-native, signed binaries. EDR misses these by design. | Windows OT workstations, engineering workstations, HMI servers | HIGH |
| Web Session Cookie Hijacking | T1539 | Steals session tokens to maintain persistence after credential resets — invalidates the standard "just rotate passwords" response. | IT/OT management platforms, SCADA web interfaces | HIGH |
| Disable Security Tools | T1562 | Disables Windows Defender, modifies WMI filters, adds exclusion paths via GPO — using legitimate admin tools, not malware. | IT domain controllers, engineering workstations | HIGH |
| Network Sniffing | T1040 | Captures domain credentials from network traffic to move laterally — passive, no noise on network sensors. | Flat OT networks, shared IT/OT switch segments | MEDIUM |
| Software Deployment Tools | T1072 | Leverages IT management tools (PDQ Deploy, SCCM, Intune) already deployed on the network as a transport mechanism for lateral movement. | Organizations with unified IT/OT management platforms | HIGH |
| Scheduled Transfer | T1029 | Schedules data staging and exfiltration at low-traffic intervals (weekends, nights) — data may not be "exfil" but staging for sabotage. | OT historian servers, process data repositories | MEDIUM |
CISA and FBI confirm Volt Typhoon has targeted the Operational Technology (OT) networks of energy, water, and pipeline organizations across the United States. Texas is disproportionately exposed given its role as the nation's largest energy producer, second-largest water consumer, and primary node for interstate natural gas pipeline infrastructure.
ERCOT operates the only independent US grid — no federal oversight of security standards during normal operations. Texas generates 30%+ of the nation's wind power and is the largest gas-fired generation state. Volt Typhoon targeting grid management systems, generation control, and transmission SCADA.
Texas water systems face compounding threats: aging infrastructure, limited cybersecurity budgets, and EPA oversight that does not mandate OT-specific security controls. Disrupting water treatment or distribution has direct human impact and is a high-value sabotage target.
Texas hosts the nation's largest pipeline network for natural gas, crude oil, and refined products. Texas pipelines serve as the delivery mechanism for roughly 25% of U.S. domestic energy supply. TSA SD 2021-01F applies but compliance is uneven at midstream operators.
The following incidents are confirmed in CISA/FBI joint reporting or attributed by government agencies. TX-specific exposure derived from published advisories and CISA ICS-CERT advisories.
| Incident / Activity | Date | Sector | TX Relevance |
|---|---|---|---|
| Volt Typhoon — OT Network Pre-positioning (AA24-038B) | 2022–present | Energy, Water, Pipeline | Direct — TX energy/water/pipeline confirmed in targeting set |
| SALT TYPHOON — Telecom Infrastructure (AA25-016) | 2022–present | Telecom / Critical Infra | Indirect — CJIS-connected utility comms at risk |
| TSA SD 2021-01F — Pipeline Security Directive | 2022–present | Pipeline | Direct — applies to all TX pipeline operators |
| OT/ICS Edge Device Exploitation (CISA Alert) | 2023–2025 | Cross-sector | Direct — OT edge devices (PLCs, RTUs) targeted |
| Volt Typhoon — Guam Military Infrastructure (DoD) | 2021–2023 | Defense | Indirect — TX defense contractors may have similar exposure |
| SCADA/ICS Vulnerabilities — TX Water Utilities (EPA) | 2024–2025 | Water | Direct — EPA SDWA reporting gap, limited OT security |
| Intrusion Set BRICKSTORM — OT Network Activity | 2024–2025 | Energy, Manufacturing | Moderate — IBM X-Force confirmed OT targeting in TX region |
| CISA AA24-038B — 24-Month Persistence Campaign | 2022–2024 | All Critical Infra | Direct — 24-month dwell confirmed; TX operators in scope |
| Detection Gap | Why It Fails | What CoreRecon Does |
|---|---|---|
| EDR Signature Detection | Volt Typhoon uses only OS-native binaries (LOLBins) — no malware to flag | Behavioral EDR with OT-aware rules + anomaly detection on admin tool usage |
| SIEM Rule Engines | Traffic patterns mimic legitimate admin activity — no anomalous signatures | OT network segmentation monitoring + lateral movement anomaly scoring |
| Threat Intel Feeds | Volt Typhoon infrastructure is low-profile — not flagged in standard IOC feeds | CISA AA24-038B IOC integration + FBI liaison reporting + dedicated OT hunts |
| VPN / Remote Access | Valid credentials used — no brute force, no anomaly at the auth layer | Session anomaly detection + JA4+ fingerprinting + out-of-band verify |
| OT/ICS Network Monitoring | Flat OT networks — no segmentation, no east-west visibility | Passive OT network monitoring (Claroty, Dragos protocol analysis) + asset discovery |
| Credential Reset Response | Web session cookie theft invalidates password rotation as remediation | Full credential invalidation protocol + session token audit + identity validation |
Ordered by immediate impact. These are specific, executable actions — not generic hardening advice.
Assume Volt Typhoon is already inside your network. Conduct OT network architecture review — map every connection between IT and OT networks. Identify VPN appliances, jump servers, and engineering workstations that bridge both environments. CoreRecon OT assessment includes passive network monitoring of IT/OT boundary traffic.
CRITICALVPN appliances, firewalls, and remote access solutions (Fortinet, Pulse Secure, Citrix, Palo Alto GlobalProtect) are the primary ingress vector. Force credential rotation on all remote access accounts. Enable hardware MFA (FIDO2/Yubikey) on all VPN access — TOTP is phishable and MFA fatigue attacks have been used against this actor.
CRITICALActive scanning of OT networks can cause disruption. Deploy passive monitoring (Claroty, Dragos, Nozomi, or CoreRecon's OT-aware SOC) to analyze live traffic on IT/OT segments. Identify anomalous Modbus, DNP3, IEC 61850 traffic. Set up alerts for工程师 workstation anomalies — Volt Typhoon uses legitimate admin tool chains that blend into normal traffic.
CRITICALMost Texas OT networks are flat — one VLAN for engineering workstations, SCADA servers, and corporate IT. Enforce physical separation between OT and IT at the network layer. PLCs, RTUs, and SCADA servers should be on isolated VLANs with no direct path to corporate IT. If a workstation on the IT side is compromised, OT must not be reachable from it.
HIGHYour IR plan does not account for OT environments if it was written for IT-only operations. Develop and tabletop test a scenario where Volt Typhoon has compromised your HMI or SCADA server. Key question: can you isolate OT from IT without disrupting physical operations? This requires coordination between IT security, OT operations, and facilities. CoreRecon Command tier includes OT IR playbook development.
HIGHFortiGate (CVE-2018-13379, CVE-2022-42475), Pulse Connect Secure, Citrix ADC, Palo Alto PAN-OS — all confirmed exploitation vectors. Patch these within 72 hours of any new CVE disclosure. For OT devices that cannot be patched (legacy PLCs, RTUs), implement compensating controls: network segmentation, jump server access, and enhanced monitoring.
HIGHIf you identify any Volt Typhoon indicators (anomalous wmic.exe / certutil.exe / bitsadmin activity on OT segments, unauthorized use of IT management tools for OT transport, session anomalies on SCADA web interfaces), report to CISA via CISA Services portal or call 1-844-NCCIC-1. CoreRecon maintains a continuously updated IOC feed derived from CISA AA24-038B, FBI liaison channels, and IBM X-Force research.
HIGHIf you operate a pipeline, TSA SD 2021-01F requires a current cybersecurity plan submitted to TSA. The May 2, 2026 compliance window for SD 2021-01F has passed — operators should ensure annual review and update cycle is current. CoreRecon's pipeline cybersecurity package includes SD 2021-01F alignment, SCADA security assessment, and TSA reporting support.
HIGH (Pipeline Only)CoreRecon's Sentinel and Command tiers include specific capabilities designed for Volt Typhoon detection and OT/IT convergence risk — not available from standard MSSPs running signature-based detection.
| Capability | Sentinel | Command | Why It Catches Volt Typhoon |
|---|---|---|---|
| 24/7 OT-Aware SOC | Included | Included | Analysts trained on LOLBin activity in OT environments — not just IT signatures |
| CISA AA24-038B IOC Feed | Included | Included | Continuously updated indicators from CISA, FBI liaison, IBM X-Force |
| Behavioral EDR (OT-safe) | Included | Included | Anomaly scoring on native binary usage — catches LOLBin without blocking OT ops |
| Passive OT Network Monitoring | Add-on | Included | No active scan — passive analysis of Modbus, DNP3, IEC 61850, BACnet traffic |
| OT Incident Response Plan | Not Included | Included | Custom IR plan for OT environments with isolation protocols |
| TSA SD 2021-01F Alignment | Not Included | Included | Pipeline cybersecurity plan development and annual review |
| vCISO (OT/IT Convergence) | Not Included | Included | Board-level reporting on OT/IT convergence risk with Volt Typhoon context |
| Quarterly OT Threat Hunt | Not Included | Included | Active threat hunt focused on OT network segments — assumes pre-positioning |
CoreRecon's OT-aware SOC closes the detection gap that signature-based tools can't address.
Get the complete Volt Typhoon threat brief with full MITRE ATT&CK mapping, TX sector risk matrix, defensive checklist, and CoreRecon OT coverage details. PDF delivered to your inbox.
No spam. One PDF, sent immediately. CoreRecon will not sell your information.
CISA AA24-038B — February 2024 Joint Advisory
Check your inbox for the full Volt Typhoon Texas Infrastructure Threat Brief PDF. If it doesn't arrive in 5 minutes, check your spam folder or email john@corerecon.com.