Volt Typhoon Is Living in Your Router and the FBI Wants You to Know About It

This is your Dragon's Code: America Under Cyber Siege podcast. Listeners, I’m Ting, and Dragon’s Code is running hot this week, so let’s jack straight into it. Over the past few days, US officials say Chinese state-linked crews have been poking and prodding at the soft underbelly of American infrastructure: power grids, port logistics, and telecom backbones. According to the Cybersecurity and Infrastructure Security Agency, the most active suspect is the group analysts call Volt Typhoon, a stealthy espionage outfit that lives off the land, meaning it abuses built‑in Windows tools like PowerShell, WMI, and stolen admin accounts instead of flashy malware. That makes their traffic look like normal system admin work, which is why defenders hate them. Microsoft and several threat intel shops report that these operators have been tunneling through small routers and VPN appliances in places like California and Texas, turning vulnerable edge devices into a shadow proxy network. From there, they hop into utility control networks and port management systems, quietly mapping which systems control what: substations, cargo cranes, even rail signaling servers tied to major freight corridors. In one of this week’s more sophisticated waves, incident responders at a large US West Coast power company say they found carefully timed credential‑stuffing attacks against their remote access portals, followed by lateral movement that targeted engineering workstations connected to SCADA test environments. No lights went out, but the goal looked obvious: learn the layouts now so they can cause chaos later. Attribution is always messy, but FBI and National Security Agency analysts point to reused command‑and‑control infrastructure previously tied to Chinese strategic support forces, Mandarin-language comments in scripts, and tasking that lines up a little too neatly with People’s Liberation Army interest in “pre‑positioning” inside US critical infrastructure. On the defense side, CISA pushed out emergency directives urging utilities and port operators to rip out or at least segment old internet‑facing gear, crank up multi‑factor authentication, and enable detailed logging on domain controllers and VPNs. Several regional grids have spun up 24/7 threat‑hunting teams, feeding telemetry into joint fusion cells with the Department of Energy and the Federal Energy Regulatory Commission. Cybersecurity experts like Dmitri Alperovitch and Jen Easterly keep hammering the same lesson: this is not smash‑and‑grab ransomware, it is patient pre‑war reconnaissance. The playbook is persistence, not publicity. The big takeaway this week is brutal but clear: if an organization cannot see every admin login, every remote connection, it is already compromised and just hasn’t noticed yet. The silver lining? Each discovered foothold forces these operators to burn infrastructure and tools, shrinking their room to maneuver. Every patched router and monitored VPN narrows the dragon’s tunnel. Thanks for tuning in, and don’t forget to subscribe so you don’t miss the next chapter of Dragon’s Code: America Under Cyber Siege. This has been a quiet please production, for more check out quiet please dot ai. For more http://www.quietplease.ai Get the best deals https://amzn.to/3ODvOta