State-Sponsored Hackers (APT): Common Tradecraft, the Threat to Taiwan Companies, and Defensive Priorities

What an APT is, and what it isn't

NIST defines an advanced persistent threat (APT) as an adversary with sophisticated expertise and significant resources that uses multiple attack vectors (cyber, physical and deception) to establish and extend a foothold in an organization's IT infrastructure, in order to exfiltrate information, undermine or impede a mission, or position itself to do so in the future; it pursues its objectives repeatedly over an extended period, adapts to defenders' efforts to resist it, and is determined to maintain the level of interaction it needs^[2]. In other words, an APT has a specific target, comes back after being evicted, and when you close one hole it finds another way in.

The definition does not say an APT must be a state, but the APT groups named in government advisories and by security vendors are mostly assessed to be linked to particular countries. Microsoft's threat actor naming, for example, separates "nation-state actors" from "financially motivated actors", the latter including ransomware operators, business email compromise and phishing^[3]. Ransomware encryption or credentials stolen through phishing are usually the work of criminal groups and need not be labeled "state-sponsored"; the typical ransomware sequence is covered in the ransomware attack chain.

The line is not always clean, though. MITRE ATT&CK describes APT41 as a group assessed to be a Chinese state-sponsored espionage group that also conducts financially motivated operations^[4], and the NSB's 2024 report says China has worked with civilian hacker groups to attack Taiwanese manufacturers using ransomware and other criminal methods^[5]. For a company, a more important question than "is this an APT?" is whether the attacker intends to stay in your environment for a long time. That determines how far back you search your logs, whether you assume all credentials are compromised, and whether reimaging one host can close the case.

Four techniques defenders need to know

Take the edge devices first

In February 2024, CISA, NSA, FBI and agencies from several other countries said in an advisory on Volt Typhoon that the group typically gains initial access by exploiting known or zero-day vulnerabilities in internet-facing network appliances such as routers, VPNs and firewalls, then connects to the victim network over VPN; the advisory names Fortinet, Ivanti, NETGEAR, Citrix and Cisco devices as frequently exploited^[6]. In August 2025, 23 agencies from 13 countries issued a joint advisory on Salt Typhoon and related activity; the initial access vulnerabilities it lists span Ivanti, Palo Alto Networks and Cisco devices, including a Cisco IOS vulnerability numbered as far back as 2018, CVE-2018-0171^[7]. The NSB's 2025 report likewise says exploitation of software and hardware vulnerabilities accounts for more than half of China's cyberattack methods against Taiwan, targeting unpatched critical infrastructure equipment to bypass login authentication and gain administrative control of devices^[1].

Once a device is taken, the compromise is hard to spot. A September 2023 advisory on BlackTech from five U.S. and Japanese agencies says the group modifies router firmware to hide its activity, with a backdoor that bypasses the router's normal logging^[8]. For full hardening guidance, see the VPN, firewall and edge device hardening checklist.

Living off the land (LOTL)

Living off the land (LOTL; the NSB's Chinese term translates as "off-the-land attacks") means abusing tools built into the system, such as PowerShell, WMIC, ntdsutil and netsh, so that malicious activity blends in with normal administration. A February 2024 joint guide from CISA and nine other agencies explains that the technique works because many organizations lack baselines that can separate normal from malicious behavior, the activity lacks conventional indicators of compromise (IOCs), and default logging configurations do not capture enough detail; CISA's red teams also frequently use LOTL for undetected, persistent access, showing that an adversary could achieve full domain compromise with little to no investment in tooling^[9].

Volt Typhoon is the textbook case. CISA and its partners call LOTL a hallmark of the group: it relies on valid accounts and built-in tools and avoids leaving malware that would trigger alerts; it uses vssadmin to create volume shadow copies and extract NTDS.dit, the file holding Active Directory password hashes; it uses PowerShell to query event logs for specific users and time periods; and it deletes selected logs to cover its tracks^[6]. The NSB's 2024 report similarly says Chinese cyber forces target vulnerabilities in Taiwanese government network devices and use living-off-the-land techniques to evade detection^[5]. Antivirus and IOC matching alone may see none of this.

Long dwell time

CISA and its partners observed Volt Typhoon maintaining access in some victims' IT environments for at least five years; after obtaining accounts the actors showed minimal activity beyond discovery and kept returning to the same organizations over several years, for example likely extracting NTDS.dit from three domain controllers in a four-year period to keep their credentials current^[6]. The Salt Typhoon advisory likewise says these actors have operated globally since at least 2021 and often modify routers to maintain persistent, long-term access^[7]. When dwell time is measured in years, a company that keeps only a few months of logs may be unable to see how an intrusion began, even after an advisory arrives.

Coming in through suppliers, telecoms and branch offices

The Salt Typhoon advisory says these actors may target edge devices regardless of who owns them: even when an organization is not a core target, its devices can still serve as a pathway to one, and the actors use provider-to-provider and provider-to-customer interconnections to pivot into other networks^[7]. The BlackTech advisory describes the actors compromising international subsidiaries of U.S. and Japanese companies, then using the trusted relationship of branch routers to pivot to other subsidiaries and headquarters networks^[8]. Volt Typhoon used end-of-life Cisco and NETGEAR small office/home office routers implanted with KV Botnet malware as relays to conceal its command-and-control traffic^[6]. Intrusions through software vendors and IT service providers are covered in supply chain attacks.

Why mid-sized companies end up in scope

The NSB's 2025 report covers nine categories of critical infrastructure (government agencies, energy, communications, transportation, emergency services and hospitals, water, finance, science parks and industrial zones, and food) and names five groups: BlackTech, Flax Typhoon, Mustang Panda, APT41 and UNC3886^[1]. Note that these are counts of intrusion attempts, not successful breaches: when the NSB's 2024 report counted intrusion attempts against Taiwan's Government Service Network using intrusion detection indicators, it stated that most had been effectively blocked^[5]. What matters more for mid-sized companies is who the report says is being targeted:

• Technology and manufacturing: beyond science parks, Chinese cyber forces have breached upstream, midstream and downstream suppliers to semiconductor and defense companies (including design, manufacturing and testing) to steal technology, industry plans and decision-making intelligence^[1].
• Telecoms and their contractors: network equipment vulnerabilities are exploited to lurk in the systems of telecom operators and their contractors^[1].
• Energy: intensive probing of energy companies' network equipment and industrial control systems, and attempts to plant malware during software updates^[1].
• IT services and the defense supply chain: intrusions into the defense supply chain and IT service providers, with particular focus on suppliers of email, official document systems, password or cipher generation, and time-and-attendance systems^[5].

MITRE ATT&CK also records that BlackTech has primarily targeted organizations in East Asia (particularly Taiwan, Japan and Hong Kong) and the U.S., including media, construction, engineering, electronics and financial companies^[4], and the Volt Typhoon advisory notes that some victims are smaller organizations with limited cybersecurity capabilities that provide critical services to larger organizations or key locations^[6]. A mid-sized company can therefore play three roles:

1. A target in its own right: process know-how, designs, customer data and quotes have intelligence value to an adversary.
2. A stepping stone to customers: if you supply or maintain systems for a large manufacturer, a telecom operator or a government agency, your VPN accounts and remote management tools into their networks are exactly the entry point an adversary wants.
3. A relay for attacks on others: unpatched or end-of-life routers and VPNs can be used to relay traffic attacking other organizations, without your name ever appearing on a victim list.

How to read government advisories that name specific groups

One group, many names. MITRE ATT&CK explains that groups are activity clusters tracked by a common name in the security community; different organizations often track similar activity under different names, and their definitions may only partially overlap^[4]. Microsoft uses weather names, with "Typhoon" indicating origin or attribution to China; for its Canary Typhoon, for example, the mapping lists other names including BlackTech, Palmerworm and CIRCUIT PANDA^[3]. The Salt Typhoon joint advisory states plainly that the activity partially overlaps with industry reporting on Salt Typhoon, OPERATOR PANDA, RedMike, UNC5807, GhostEmperor and others, and that the authoring agencies do not adopt any commercial naming convention, referring instead to "APT actors"^[7]. Before working through an advisory, use MITRE ATT&CK's group pages or vendor mappings to check whether several reports describe the same group.

Attribution is the issuing agency's judgment. Advisories use language such as "assess" and "high confidence". For example, the U.S. authoring agencies said Volt Typhoon's choice of targets and pattern of behavior is not consistent with traditional cyber espionage and assessed "with high confidence" that the group is pre-positioning on IT networks to move laterally to operational technology (OT) and disrupt its functions^[6]. When quoting, write "agency X says", not your own assertion. Companies rarely need, or have enough data, to attribute attacks themselves; the effort belongs in checking whether the techniques in an advisory apply to your environment.

Pull out what you can act on:

• Affected products and CVEs: check them against your asset inventory, including old vulnerabilities. See how to prioritize patches for ordering.
• Techniques and ATT&CK IDs: check whether your logs and detection rules can see these behaviors.
• Indicators of compromise: note the observation window. The IP indicators in the Salt Typhoon joint advisory span August 2021 to June 2025, and the authoring agencies warn that some may no longer be in use and should be vetted before blocking^[7]. See how to check your environment against advisory IOCs.
• Detection advice: the BlackTech advisory notes that it would be trivial for the actors to render specific signatures obsolete, and that monitoring network devices for unauthorized bootloader and firmware downloads and unexpected reboots is more robust^[8]. Behavior-based detection generally outlasts any single signature.

Defensive priorities: five things to do first

1. Edge devices: patch, reduce exposure, store no domain credentials

The Volt Typhoon advisory recommends patching internet-facing systems within a risk-informed timeframe, prioritizing critical assets, known exploited vulnerabilities and devices the group frequently exploits; not exposing unnecessary systems or management interfaces to the internet; planning replacement of technology past its supported lifecycle; not storing credentials on edge devices; and making sure edge devices hold no accounts that could provide domain administrator access^[6]. The Salt Typhoon joint advisory recommends placing device management services in a dedicated out-of-band management network, disabling outbound connections from management interfaces, forwarding logs to a central server, and regularly auditing device configurations through change management^[7].

2. Catch living off the land with logs and baselines

Priorities from the LOTL joint guide include^[9]:

• Enable detailed logging, including command lines, PowerShell and WMI activity, and aggregate it in a central location that attackers cannot reach and that cannot be altered once written.
• Establish and continuously maintain baselines of installed tools, account behavior and network traffic.
• Keep a small set of approved administrative tools with extensive logging, and block or alert on all others; avoid overly broad exceptions for tools such as PsExec.
• Profile normal privileged account behavior (which tools, which commands, which hours, which devices), and at minimum move Active Directory administrators onto dedicated privileged access workstations first.

Domain controllers are a good place to start: the guide notes that in a typical enterprise, using ntdsutil to snapshot the Active Directory database is usually not a routine task, and that the command line recorded in Security event 4688 or Sysmon event 1 can reveal it^[9].

3. Identity and privileged accounts

The Volt Typhoon advisory recommends phishing-resistant MFA, separating user and privileged accounts, significantly limiting the number of privileged users while continuously monitoring privileged group membership, and implementing an Active Directory tiering model; it also notes that the group targets IT staff's personal email accounts and advises encouraging staff to protect them with strong passwords and MFA^[6]. For choosing MFA methods, see the MFA rollout guide.

4. Segmentation and a review of connections

The Volt Typhoon advisory recommends denying all connections to the OT network by default and routing necessary IT-OT communication through a closely monitored intermediary such as a firewall, jump host or DMZ^[6]. The BlackTech advisory urges multinational companies to review all subsidiary connections, verify access and consider zero trust models^[8]. For Taiwan companies, leased lines and VPNs to overseas plants, branch offices, suppliers and customers all belong in that review.

5. Keep logs long enough to look back across the dwell time

The LOTL joint guide recommends extending log retention and strengthening threat hunting to uncover prolonged adversary presence, and notes that most network devices have limited local storage, so centralized logging is what preserves a longer history^[9]. The Salt Typhoon joint advisory recommends a central log server holding immutable logs, with retention long enough to support incident investigations^[7]. In Taiwan, the information system protection baseline in Annex 10 of the Regulations Governing the Classification of Cyber Security Responsibility Levels, as amended in January 2026, requires government agencies and specific non-government agencies to set a log retention policy and keep logs for at least six months^[10]. That is a legal minimum, and it falls short of dwell times measured in years. A tiered approach helps: keep recent logs on a fast search platform, and keep edge device, VPN, domain controller and privileged account logs longer in lower-cost storage. For who the regulation applies to, see Taiwan's Cyber Security Management Act.

Action checklist

• Inventory every internet-facing device, including routers and VPNs at overseas plants, branch offices and small sites; schedule replacement of end-of-life devices.
• Check whether edge devices store domain credentials or accounts with domain admin rights, and replace them with least-privilege dedicated accounts.
• Enable command-line and PowerShell logging on domain controllers and key servers, send it with edge device logs to a tamper-proof central store, and confirm actual retention meets at least the legal minimum, with key logs kept longer.
• List approved administrative tools and alert on ntdsutil, vssadmin and similar commands run on domain controllers.
• Separate privileged and everyday accounts, move to phishing-resistant MFA, and monitor privileged group membership changes.
• Review leased lines and VPNs to subsidiaries, suppliers and customers; close what is unnecessary and restrict the rest by source and service.
• For every advisory that names a specific group, assign someone to extract affected products, techniques and IOCs and check them by a deadline; subscribe to alerts so new advisories reach that person directly.
• If a check finds a match or anything abnormal, follow the first 24 hours of a suspected breach; if you need outside help, see our incident response service.