Volt Typhoon has all the hallmarks of being an advanced persistent threat (APT) focused on long\u2011term access to critical infrastructure, including communications, energy, transport, and water\/wastewater sectors. The group has been repeatedly highlighted in 2024\u20132025 joint advisories for quietly embedding itself in infrastructure networks to be ready for potential future crises, rather than for immediate impact.<\/p>\n
Heading into 2026, the strategic concern is that this persistent access can be activated to disrupt services at times of geopolitical tension, elections, or regional conflict, with cascading impacts across supply chains and government services. This makes operational resilience, incident response readiness, and OT\u2011aware detection capability board\u2011level priorities rather than optional enhancements.<\/p>\n
Tradecraft: Quiet Access, Disruptive Potential<\/strong><\/p>\n Volt Typhoon\u2019s operations typically begin with careful reconnaissance to map networks, trust relationships, and remote access services, including smaller or regional service providers that support larger critical infrastructure operators. The group frequently exploits internet\u2011facing appliances and services, then pivots to credential theft and \u201cliving off the land\u201d techniques that blend almost perfectly with legitimate admin activity.<\/p>\n Instead of relying on bespoke malware, Volt Typhoon prefers native tools, valid accounts, and existing remote management channels, dramatically reducing detection by traditional signature\u2011based controls. In documented cases, the group has reached control systems inside critical infrastructure environments and positioned itself to move further into OT, raising real concerns about the ability to manipulate HVAC, power, or water systems during a crisis.<\/p>\n The Australian Signals Directorate (ASD)\u2019s current message is that critical infrastructure operators must assume state\u2011sponsored actors like Volt Typhoon are already targeting (or in) their environments and respond with a mix of standards based uplift and OT\u2011specific resilience measures such as isolation and rapid rebuild capability. The emphasis in 2025\u201326 is on asset visibility, edge\u2011device and identity hardening, and the ability to keep vital services running even if parts of the network need to be cut off for months.<\/p>\n Core ASD Guidance Themes<\/strong><\/p>\n ASD frames its advice around building resilience to severe incidents, not just preventing minor breaches. Guidance now combines classic ICT controls (NIST, E8, ISM) with OT\u2011specific practices based in applicable standards (e.g. AS 62443) for critical infrastructure operators.<\/p>\n Key themes include:<\/p>\n ASD\u2019s \u201cPrinciples of operational technology cyber security\u201d call out that OT must be segmented and governed differently to corporate IT. The focus is on preventing IT compromise from cascading into OT and limiting lateral movement once an adversary is inside.<\/p>\n Key principles relevant to Volt Typhoon\u2011style actors include:<\/p>\n CI Fortify: Isolate And Rebuild<\/strong><\/p>\n In late 2025 ASD released the CI Fortify<\/em> guidance specifically for critical infrastructure and OT environments. This explicitly responds to the risk of state\u2011sponsored actors pre\u2011positioning for disruption (Volt Typhoon being the flagship example).<\/p>\n CI Fortify centres on:<\/p>\n ASD stresses that these capabilities also improve resilience to natural disasters and supply\u2011chain disruptions, not just cyber events.<\/p>\n Volt Typhoon \/ PRC\u2011Specific Advice<\/strong><\/p>\n ASD\u2019s joint advisory on PRC state\u2011sponsored activity (including Volt Typhoon) aligns with US and Five Eyes partners and explicitly warns that Australian critical infrastructure could be targeted in similar ways. The fact sheet for leaders calls on executives to treat this as a critical business risk and to resource cyber teams accordingly. More can be read at: https:\/\/www.cyber.gov.au\/about-us\/view-all-content\/alerts-and-advisories\/prc-state-sponsored-actors-compromise-and-maintain-persistent-access-us-critical-infrastructure<\/p>\n In summary, recommended actions include:<\/p>\n What This Means Practically For 2026 Security Programs<\/strong><\/p>\n For Anchoram\u2019s clients, \u201cwhat ASD says\u201d effectively translates into four program pillars for 2026:<\/p>\n Aligning rail, water, energy, and defence\u2011estate programs with such ASD publications gives operators both practical security outcomes and clear evidence of adherence to contemporary Australian government expectations<\/p>\n What This Means For Anchoram\u2019s Clients In 2026<\/strong><\/p>\n For government agencies and regulated operators, 2026 is the year when \u201cquiet pre\u2011positioning\u201d becomes a central planning assumption for risk, not a hypothetical outlier. The focus shifts from purely preventing ransomware and data breaches to ensuring essential services can withstand targeted attempts to disrupt OT and supporting IT systems during national or regional crises.<\/p>\n Anchoram\u2019s work across government, defence, rail, and utilities enables clients to translate these high\u2011end threats into practical actions: more mature Essential Eight implementation, defensible segmentation between IT and OT, and assurance that remote access, vendor connections, and edge devices are governed and monitored as critical assets. This requires balancing standards like ASD Essential Eight, AESCSF, IEC 62443, and DISP with real\u2011world constraints in brownfield plants, rolling stock, and complex supply chains.<\/p>\n Anchoram\u2019s 2026 Priority Themes<\/strong><\/p>\n To help boards and executives respond credibly to Volt Typhoon\u2011class adversaries in 2026, Anchoram centres its narrative and services around a small set of priority themes. These themes speak directly to the evolving threat landscape and the expectations of regulators, ministers, and communities that rely on essential services.<\/p>\n For Anchoram, helping customers develop a 2026 focused strategy for threats such as Volt Typhoon and peer actors is a chance to provide real world experience in combatting threats based on our experience within Critical Infrastructure, Australian government, Defence estates, inclusive of rail, water, and energy.<\/p>\n We aim to frame our services around credible adversary tradecraft and realistic disruption scenarios, to help clients move from generic \u201ccritical infrastructure is at risk\u201d statements to targeted, funded programs and strategies that materially reduce the likelihood and impact of cyber\u2011physical incidents.<\/p>\n\n
\n
\n
\n
\n
\n
\n
\n