How Volt Typhoon Weaponizes Active Directory

Cybersecurity Under Pressure. Real Attacks, Real Lessons · Oct 28, 2026 · 40m

Volt Typhoon turns trusted administration into a path toward critical infrastructure. This episode examines how stolen credentials, Active Directory compromise and living-off-the-land activity can undermine confidence in the systems operators depend on.

We explore the identity boundary between enterprise IT and operational technology, the evidence defenders need to distinguish legitimate administration from an intrusion, and the recovery decisions that follow a suspected domain compromise.

Sources and further reading:

Joint CISA advisory AA24-038A…