Adversary Engine: Volt Typhoon
A ten-section workbook assessed against the ASD Essential Eight Maturity Model. You are working the full MITRE ATT&CK kill chain of Volt Typhoon - pre-positioning and long-dwell persistence inside critical infrastructure with zero custom malware. Every section must be completed before the workbook can be submitted; the assessor then returns a maturity verdict, per-domain findings and prioritised actions.
Quiet, persistent access to operational and enterprise systems that survives rebuilds and credential resets, for use on a timetable you do not control.
An action scores 0.0 if ANY scoped asset class fails an Indicator of Good Practice, however strong its rating.
A domain scores the lowest of its supporting actions. One failing action caps the whole principle.
Coverage is checked against edge appliances, cloud tenancies and OT jump boxes, not just IT endpoints.
DET-01 central logging and DET-04 behavioural detection must capture LotL execution and anomalous authentication.
9 of 10 sections unlock as earlier sections are completed. Select any open section to jump to it.
Section 1 - Scope and participant
This workbook is assessed against the ASD Essential Eight Maturity Model through the Volt Typhoon kill chain. Name the assessor, the organisation and the asset classes this workbook is claiming to cover. Coverage claims are checked against these classes in every later section.
Only claim a class you can evidence. An action rated effective against a class you cannot cover scores 0.0.
Required before continuing: full name, a valid work email, organisation, sector, at least one asset class
Silent Train: the relay chain the Essential Eight never sees
Before touching a victim, Volt Typhoon staged access through cloud relays and compromised small-office routers. Each hop was reached with credentials taken from the hop before it, so the intrusion arrived as an ordinary HTTPS session from a domestic residential address - and produced nothing for endpoint controls to detect.
- TP-LINK WR* calls back to Alibaba Cloud over HTTP/8281 for tasking, so no inbound session has to stay open.
- Every hop after the routers is reached with credentials recovered from the previous device - no malware is dropped, so nothing is quarantined or signatured.
- Compromised residential routers give the operator U.S. egress addresses, so victim-side logs show domestic, consumer ISP traffic.
How the chain defeats each Essential Eight mitigation
Patch applications and restrict administrative privileges are the only Essential Eight mitigations that touch the Silent Train path, and both were defeated at the network edge. Application control, macros, application hardening, OS patching and MFA all govern assets the operator never needed to touch. Backups change what a disruption costs, not whether the foothold exists.
- -The Essential Eight is endpoint and identity centric - it assumes the fight happens on managed workstations, servers and logins.
- -Edge and consumer-grade network devices are frequently outside the asset register, the patch pipeline and privileged access management, which is exactly why they were chosen.
- -Nothing in the Essential Eight is a detection control. An intrusion built on valid credentials, native tools and domestic residential egress has no signature to trip.
Chain reconstruction from Black Lotus Labs (Lumen) Silent Train reporting and the ASD-led joint advisory on Volt Typhoon (AA24-038A). Router models are anonymised as published. Mapped against the ACSC Essential Eight mitigations; illustrative for training, not a statement of any single victim's defensive posture.
Adversary behaviour derived from public reporting on Volt Typhoon (Black Lotus Labs Silent Train, ASD-led advisory AA24-038A) · MITRE ATT&CK® is a registered trademark of The MITRE Corporation · Educational simulation, not an assessment of any single environment