Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
U.S. and international agencies said Volt Typhoon maintained access to some victims’ IT environments for at least five years. That finding does not mean every U.S. critical-infrastructure network was compromised for five years; the agencies’ concern was that the access could help the attackers reach operational technology and disrupt essential services during a major crisis or conflict.
What did federal agencies find?
In a joint advisory released February 7, 2024, CISA, the National Security Agency, the FBI and international partners described long-term Volt Typhoon footholds in some victim IT environments. The agencies assessed with high confidence that the activity was pre-positioning for possible disruption, rather than simply collecting information.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Network Security, Firewalls, and VPNs | $66.62 | Buy on Amazon |
| 2 |
|
Network Security, Firewalls, and VPNs: . (Issa) | $60.09 | Buy on Amazon |
| 3 |
|
TP-Link ER605, Wired Gigabit VPN Router | $49.99 | Buy on Amazon |
| 4 |
|
Cybersecurity for Small Networks: A Guide for the Reasonably Paranoid | $33.22 | Buy on Amazon |
The distinction matters: “at least five years” describes access in some environments, not a finding that every critical-infrastructure operator—or every network in a named sector—was continuously compromised for that length of time.
What was Volt Typhoon trying to do?
The agencies assessed that Volt Typhoon was positioning itself on IT networks so it could move laterally toward operational technology (OT). OT includes the systems used to monitor or control physical processes and services. The stated concern was that, in a major geopolitical crisis or military conflict, the actors could potentially disrupt or destroy critical functions.
#1 Best Overall
That assessment frames the campaign as a potential disruption threat, not just conventional cyber espionage. It describes an intended capability and risk; it does not establish that the group caused a service disruption through this access.
Which critical-infrastructure sectors were named?
The February 2024 joint advisory identified targets in these sectors across the continental and non-continental United States, including Guam:
Rank #2
- Available with the Cloud Labs which provide a hands-on, immersive mock IT infrastructure enabling students to test their skills with realistic security scenarios
- New Chapter on detailing network topologies
- The Table of Contents has been fully restructured to offer a more logical sequencing of subject matter
- Introduces the basics of network security—exploring the details of firewall security and how VPNs operate
- Increased coverage on device implantation and configuration
- Communications
- Energy
- Transportation systems
- Water and wastewater systems
How did the attackers try to stay hidden?
The advisory describes “living off the land”: using legitimate tools already present in a victim’s environment instead of relying only on conspicuous, unfamiliar software. It also notes use of valid accounts, extensive reconnaissance before exploitation, tactics tailored to individual victims, and sustained effort to maintain access and understand target networks. Together, those practices can make malicious activity resemble ordinary administration and leave defenders with fewer obvious indicators.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
In a May 24, 2023 statement, then-CISA Director Jen Easterly said, “For years, China has conducted aggressive cyber operations to steal intellectual property and sensitive data from organizations around the globe.” That describes a broader pattern of Chinese cyber activity. NSA Cybersecurity Director Rob Joyce described the stealth technique in a separate May 24 statement: “A PRC state-sponsored actor is living off the land, using built-in network tools to evade our defenses and leaving no trace behind.” These statements provide context; the specific pre-positioning assessment comes from the February 2024 joint advisory.
Does the five-year finding mean the threat ended?
No. A separate CISA advisory, last revised September 3, 2025, said PRC state-sponsored actors continued compromising networks globally, including in telecommunications, government, transportation, lodging and military infrastructure. It also warned that actors often modified routers to preserve persistent access. This later advisory concerns broader PRC activity and should not be read as a new five-year duration finding about Volt Typhoon or as proof that every listed organization was affected.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should critical-infrastructure operators do?
The joint advisory’s defensive actions focus on reducing exposed entry points, making stolen credentials harder to use, improving visibility, and preparing to detect and respond to persistent access:
Rank #3
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
- Patch internet-facing systems. Prioritize vulnerabilities known to be exploited, rather than treating every update as equally urgent.
- Require phishing-resistant multifactor authentication. Apply it to accounts that can access important systems and services.
- Centralize application, access and security logs. Keep the records defenders need to identify suspicious activity and investigate it across systems.
- Plan to retire unsupported technology. Track equipment and software beyond manufacturer support and establish a replacement plan.
- Threat-hunt and prepare response procedures. Look for activity resembling the advisory’s described tradecraft, and ensure incident-response procedures are ready to use.
- Report suspicious activity. Contact CISA or the FBI.
Because the described activity can use valid accounts and built-in tools, operators should not rely solely on alerts for unfamiliar malware. Reviewing account use and administrative activity alongside centralized logs can help surface activity that otherwise blends into routine operations.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
