IR223 - Anatomy of an Attack Series - Hunting the Hidden: Volt Typhoon

#1719401: IR223 - Anatomy of an Attack Series - Hunting the Hidden: Volt Typhoon - 10 th FEB, 2026

Description:	This dynamic, full-day training immerses cybersecurity professionals in the stealthy world of advanced persistent threats (APTs). Participants will dissect the real-world tactics, techniques, and procedures (TTPs) associated with Volt Typhoon—a sophisticated nation-state actor known for its use of living-off-the-land (LOTL) methods and deep persistence within enterprise environments. Through guided labs and threat hunting scenarios, participants will learn to surface malicious behavior that blends seamlessly into normal system activity. Using endpoint and network telemetry, participants will practice detecting subtle indicators of compromise and take steps toward containment and response—gaining critical skills. This course emphasizes operational realism and is ideal for defenders looking to enhance their ability to uncover covert adversary activity. Learning Objectives By the end of this workshop, participants will be able to: -Identify tactics, techniques, and procedures (TTPs) used by Volt Typhoon, mapped to the MITRE ATT&CK framework -Detect suspicious behavior in endpoint and network logs -Analyze system enumeration and persistence patterns -Correlate telemetry and artifacts across multiple data sources to build a timeline of attacker activity -Develop a focused incident response approach
More info:	https://cisa.webex.com/webappng/sites/cisa/webinar/webinarSeries/register/7242e862a74e434e843b4a71777a4961

Description:

This dynamic, full-day training immerses cybersecurity professionals in the stealthy world of advanced persistent threats (APTs). Participants will dissect the real-world tactics, techniques, and procedures (TTPs) associated with Volt Typhoon—a sophisticated nation-state actor known for its use of living-off-the-land (LOTL) methods and deep persistence within enterprise environments.

Through guided labs and threat hunting scenarios, participants will learn to surface malicious behavior that blends seamlessly into normal system activity. Using endpoint and network telemetry, participants will practice detecting subtle indicators of compromise and take steps toward containment and response—gaining critical skills.

This course emphasizes operational realism and is ideal for defenders looking to enhance their ability to uncover covert adversary activity.

Learning Objectives
By the end of this workshop, participants will be able to:
-Identify tactics, techniques, and procedures (TTPs) used by Volt Typhoon, mapped to the MITRE ATT&CK framework
-Detect suspicious behavior in endpoint and network logs
-Analyze system enumeration and persistence patterns
-Correlate telemetry and artifacts across multiple data sources to build a timeline of attacker activity
-Develop a focused incident response approach

More info:

https://cisa.webex.com/webappng/sites/cisa/webinar/webinarSeries/register/7242e862a74e434e843b4a71777a4961

Date added	Jan. 10, 2026, 8:12 a.m.
Source	Webex
Subjects	. APTs - Advanced Persistent Threats - New Reports in China - Volt Typhoon APT / DEV-0391 / Vanguard Panda / BRONZE SILHOUETTE / UNC3236 / Voltzite / Insidious Taurus / BRONZE SILHOETTE PodCasts / Webcast / Webinar / eSummit / Virtual Event etc.
Venue	Feb. 10, 2026, midnight - Feb. 10, 2026, midnight