Forest Global Training Partners

Cyber Risks · Cisco Talos

State-sponsored actors, better known as the friends you don’t want

Summary: Cisco Talos writes that state-sponsored actors operate inside the trust boundary using trusted tools, valid credentials, and actions that appear authorized, and that they follow the same Lockheed Martin Cyber Kill Chain phases as criminal attackers but with covertness as the objective. The article cites Volt Typhoon moving from compromised IT infrastructure toward OT-adjacent systems including water treatment plants and electrical substations, and through 2025 progressing to direct interaction with OT network-connected devices and extraction of sensor and operational data.

Bottom line: Volt Typhoon's shift from passive espionage to a sabotage-ready foothold in OT networks means the adversary may already be positioned inside infrastructure you treat as trusted, and standard playbooks built around malware containment and ransomware recovery do not cover it.

Read the original at Cisco Talos ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026