Under the Radar: How Volt Typhoon Hackers Infiltrated a U.S. Power Utility for 300 Days

A Chinese state-sponsored group breached a small Massachusetts utility and stayed for 300 days without being caught.

Volt Typhoon gained access to LELWD in February 2023 through an unpatched FortiGate 300D firewall, remained undetected for roughly 300 days, and used that time to steal operational technology data about how the utility runs its grid, until the FBI alerted the utility in November 2023.

The entry point was a network firewall that had missed a critical security update. Fortinet had issued the fix, but the appliance guarding LELWD's edge was still exposed, and that single gap was enough. Once inside, the attackers did not rush. They moved laterally across the network over months, using Server Message Block traversal and Remote Desktop Protocol connections to reach the systems they wanted.

What they were after tells you their intent. Investigators found the group focused on stealing operational technology information: how the utility's OT procedures worked, the spatial layout of energy grid operations, and network architecture details. That is reconnaissance data. It is the blueprint you would want if your goal was to disrupt the same grid at a chosen moment in the future. According to CISA's own reporting, Volt Typhoon has maintained access to some U.S. critical infrastructure targets for as long as five years, so LELWD's 300 days is not an outlier. It is the pattern.

The response is the one bright spot. LELWD had already joined a government-funded American Public Power Association program and was in the middle of rolling out the Dragos platform when the tip came. Dragos accelerated the deployment, confirmed the intrusion through its OT threat hunting, and helped the utility rebuild its network architecture to shut the door. Without that head start, the utility would have been investigating blind.

Living-off-the-land tactics let Volt Typhoon blend into normal network traffic instead of dropping malware that gets flagged.

Volt Typhoon stayed hidden by living off the land, meaning it used the tools and accounts already present in the network rather than planting malware, so its activity looked like ordinary administration and slipped past defenses tuned to catch known-bad files.

Most small businesses picture a breach as a virus, a file the antivirus should have caught. Volt Typhoon works differently. Living off the land means the attacker uses built-in Windows utilities, legitimate remote-access protocols, and valid credentials to move around. There is often no malicious file to scan, no signature to match. To a monitoring tool watching for known threats, a Volt Typhoon operator can look like an IT admin doing routine work at an odd hour.

That is why the intrusion ran for 300 days. The techniques Dragos documented at LELWD, Server Message Block traversal to reach file shares and Remote Desktop Protocol to hop between machines, are the same tools real administrators use every day. Detecting this class of attack is not about a better virus scanner. It requires watching behavior over time and asking whether a given account should be talking to a given system at all. In 35 years around IT, the intrusions that hurt the most were rarely loud. They were the ones nobody was set up to notice.

The firewall gap that let them in matters just as much as the stealth that kept them in. LELWD's edge appliance had missed a critical update. This is the ordinary failure, not the exotic one, and it is the part every business can actually control. A single unpatched device with a public-facing service is the most common front door a nation-state walks through, and it is also the cheapest one to close.

Because small utilities and their vendors are the soft, under-resourced entry point into critical infrastructure.

Nation-state groups target small utilities like LELWD precisely because they are lean, run tight budgets, often depend on a single outside IT provider, and lack full-time OT security staff, which makes them a quieter way into the broader critical-infrastructure ecosystem than a hardened major operator.

The instinct that "we are too small to matter" is exactly the assumption these groups count on. A large regional utility has a security operations center, dedicated OT engineers, and layers of monitoring. A municipal department serving two towns has none of that, yet it still runs real grid equipment and still connects to the wider energy ecosystem. For an attacker whose goal is a durable foothold in U.S. infrastructure, the small operator is the higher-value, lower-effort target.

There is a supply-chain angle that reaches well beyond the utility itself. LELWD's original exposure traced back in part to a managed service provider that had not kept the firewall firmware current. That is the recurring theme of Volt Typhoon: it hunts for the weakest link connected to the target, and often that link is a vendor, a contractor, or a small partner with network access. The utility does not have to be careless for the chain to break. One under-resourced supplier is enough.

Houston sits at the center of the American energy sector. The metro is thick with oil and gas operators, engineering firms, equipment suppliers, and service contractors that plug into utility and industrial networks every day. A small firm here that would never call itself "critical infrastructure" can still be a stepping stone toward it. That is not a scare tactic. It is how VOLTZITE builds access, and it is why the size of your company is not what determines whether you are a target.

Because attackers reach critical infrastructure through the small vendors and partners connected to it, and Houston is full of them.

A Houston SMB should care because the LELWD intrusion shows attackers pivot into critical infrastructure through the small, connected businesses around it, and an oil-and-gas contractor, engineering firm, or equipment supplier in the Houston metro is exactly the kind of connected link Volt Typhoon looks for.

Think about what "connected" really means for a Gulf-Coast energy business. Your team may have remote access into a client's plant network. You may exchange files with a utility, host a portal a partner logs into, or run equipment that reports back to an industrial control system. Every one of those links is a path, and an attacker who cannot breach the well-defended utility directly will happily breach you first and ride the connection in.

The practical takeaways from LELWD are not exotic. They are the fundamentals, done consistently:

• Patch the edge first. The breach started with an unpatched firewall. Public-facing devices, VPNs, and firewalls are the highest-priority updates you have, and disciplined patch management closes that door.
• Separate IT from OT. If you run any operational or industrial equipment, it should not sit flat on the same network as email and file sharing. Segmentation limits how far a foothold can spread.
• Watch behavior, not just files. Living-off-the-land attacks leave no malware to scan. You need monitoring that flags a normal account doing abnormal things, which is what managed detection and response provides.
• Vet your vendors, and be a vendor worth trusting. LELWD's firmware gap was a provider failure. Ask who patches your gear, and make sure your own access into client networks is not the weak link.

None of this requires a nation-state budget. It requires treating the boring fundamentals, patching, segmentation, and monitoring, as the actual security program they are. That is the gap between LELWD's 300 days and an intrusion caught in a week.

CinchOps is a managed IT services provider based in Katy, Texas, serving small and mid-sized businesses across the Houston metro area.

CinchOps specializes in cybersecurity, network security, managed IT support, VoIP, and SD-WAN for businesses with 10-200 employees. The LELWD intrusion is a clean checklist of the failures we work to prevent for Houston companies in and around the energy sector: an unpatched edge device, a flat network with no IT and OT separation, and no monitoring able to catch a quiet intruder. For a Houston SMB, that means:

• Edge and firewall patch management. We keep public-facing devices, firewalls, and VPNs current, so the door that let Volt Typhoon into LELWD stays shut on your network.
• IT and OT segmentation. We separate business systems from any operational or industrial equipment, so a foothold in one cannot roam into the other.
• Behavior-based detection. We watch for the normal-looking account doing abnormal things, the signature of living-off-the-land attacks that file scanners miss.
• Vendor and supply-chain hygiene. We help you close the gaps that make you the weak link into a client's network, and verify that your own providers are doing the same.

CinchOps serves businesses across Houston, Katy, and Sugar Land, with industry experience in oil and gas, energy and utilities, and engineering firms - the exact Houston supply-chain businesses a group like Volt Typhoon uses as a way in.

Your company does not have to be a power plant to be a target. If you touch a utility, an energy operator, or their vendors, you are part of the chain that groups like Volt Typhoon probe first. If you want the unpatched device found and the flat network fixed before someone else finds them, talk to CinchOps and start with an honest assessment of your edge.