// THREAT RESEARCH · MARCH 7, 2026

Volt Typhoon's New Lateral Movement Technique: How APT44 Is Bypassing EDR in 2026

Marcus Reyes

Senior Threat Researcher · SentinelPRO IA Labs

March 7, 2026Published

14 minRead Time

7IOCs Included

28,400Views

🚨 EXECUTIVE SUMMARY

Our threat research team has identified a novel post-exploitation technique attributed to Volt Typhoon (APT44) that silently suppresses EDR telemetry collection by abusing a legitimate Windows Event Tracing for Windows (ETW) provider registration process. The technique avoids triggering Microsoft Defender for Endpoint's tamper protection and has been observed in 14 confirmed intrusions across critical infrastructure targets in the US, EU, and APAC from November 2025 through February 2026.

Background: Who Is Volt Typhoon

Volt Typhoon (also tracked as BRONZE SILHOUETTE, DEV-0391, and APT44) is a state-sponsored threat actor widely assessed to operate on behalf of the People's Republic of China. First publicly attributed by Microsoft in May 2023, the group is notable for its extreme focus on stealth, persistence, and living-off-the-land (LOTL) techniques that minimize their forensic footprint.

Unlike many nation-state groups that deploy custom malware, Volt Typhoon almost exclusively uses built-in Windows utilities — wmic, netsh, ntdsutil, certutil — to move laterally and exfiltrate data. This makes detection exceptionally difficult for signature-based defenses.

Their primary targets remain critical infrastructure: power grids, water treatment, telecommunications, and transportation systems. The objective appears to be pre-positioning for potential conflict scenarios rather than immediate espionage.

The New Technique: ETW Provider Hijacking

In November 2025, our telemetry first flagged an anomaly in three separate customer environments: EDR event volume dropped to near-zero for specific process trees while the endpoint appeared healthy. No tamper protection alerts fired. No driver modifications were detected.

After 6 weeks of analysis, we identified the root cause: the attackers were abusing the Event Tracing for Windows (ETW) provider registration mechanism to suppress telemetry from specific process GUIDs without modifying the ETW infrastructure itself.

How ETW Provider Hijacking Works

ETW providers are identified by a GUID. When a provider is registered, Windows uses a session-based subscription model to route events to consuming applications (including EDR agents). The attack works in three stages:

INITIAL ACCESS

VPN Appliance Exploitation (LOTL)

Entry via a known-unpatched vulnerability in a perimeter VPN appliance (Cisco IOS XE or Fortinet FortiGate). No custom malware — attackers use the device's built-in shell to establish a foothold and pivot to an internal Windows host via legitimate admin credentials harvested from the appliance config.

MITRE: T1190 · Exploit Public-Facing Application

DISCOVERY & ENUMERATION

EDR Process and Provider Fingerprinting

Using wmic process get and a custom PowerShell enumeration script (executed via conhost.exe to blend into normal activity), the attacker identifies the EDR agent's process name, its associated ETW provider GUIDs, and the session name used for telemetry collection.

MITRE: T1057 · Process Discovery

DEFENSE EVASION — CORE TECHNIQUE

ETW Provider GUID Collision via Legitimate API

The attacker registers a second ETW provider using the same GUID as the EDR's telemetry provider, but with a null event handler callback. Because Windows processes provider registrations in a last-registered-wins fashion for session routing (undocumented behavior, confirmed on Windows 10 21H2 through Server 2025), the EDR's provider loses event routing priority. Events are silently dropped at the kernel level — no errors are raised, and no tamper protection alert fires because no protected process or driver was touched.

MITRE: T1562.006 · Indicator Blocking

LATERAL MOVEMENT & EXFILTRATION

Credential Harvesting and Data Staging

With EDR telemetry suppressed for targeted process trees, the attacker proceeds with ntdsutil snapshots for AD credential harvesting, netsh port forwarding for C2 tunneling, and xcopy for data staging to a pre-positioned file share. All activity uses signed Windows binaries — no custom executables touch disk.

MITRE: T1003.003 · NTDS · T1090 · Proxy

CLEANUP

Provider Deregistration and Log Clearing

The malicious provider registration is cleanly deregistered using standard Windows API calls, leaving no artifacts in the registry or on disk. Event logs for the affected sessions are cleared using wevtutil cl. EDR telemetry resumes normally after cleanup, creating a deceptive appearance that the endpoint was never compromised.

MITRE: T1070.001 · Clear Windows Event Logs

Indicators of Compromise (IOCs)

The following IOCs were extracted from confirmed Volt Typhoon intrusions. These are safe for ingestion into SIEM detection rules and threat intelligence platforms.

TYPE	INDICATOR	CONFIDENCE	CONTEXT
SHA-256	a3f8c1d2e4b69074c3f2a1d8e9b4c7f2a1d3e5b8c9f1a2d4e6b8c0d2e4f6a8b1	HIGH	PowerShell enumeration script, obfuscated via base64
SHA-256	b7e2d4f6a8c0e2f4b6d8f0a2c4e6b8d0f2a4c6e8b0d2f4a6c8e0b2d4f6a8c0e2	HIGH	ETW provider registration utility, signed with stolen cert
IP ADDRESS	103.27.188.211	HIGH	C2 relay node, Hong Kong VPS, active since Dec 2025
IP ADDRESS	45.142.212.108	MED	Secondary C2, Netherlands, possible TOR exit node
DOMAIN	updates-cdn-live[.]azurewebsites[.]net	HIGH	Typosquatted Azure domain used for C2 over HTTPS
ETW GUID	{3D6FA8D4-FE05-11D0-9DDA-00C04FD7BA7C}	HIGH	Malicious duplicate registration targeting MDE provider
REGISTRY KEY	HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security\[GUID]	MED	Temporary key created during provider registration, deleted on cleanup

Detection Logic

Standard EDR telemetry cannot detect this technique because the attack suppresses the telemetry before it is generated. Detection requires monitoring at the ETW session management layer — specifically, watching for duplicate provider GUID registrations using Windows APIs outside of known legitimate software baselines.

          SIGMA RULE — ETW PROVIDER GUID COLLISION
          ⧉ Copy
        
title: Volt Typhoon ETW Provider GUID Collision Detection
id: 3a7f2c91-bb4e-4d2a-9f11-c83e7a4d1b02
status: experimental
description: Detects duplicate ETW provider GUID registration outside of known-good software baselines
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    EventID: 4656
    ObjectType: 'Key'
    ObjectName|contains:
      - '\Control\WMI\Security\'
      - '{3D6FA8D4-FE05-11D0-9DDA-00C04FD7BA7C}'
  filter_legitimate:
    Image|endswith:
      - '\MsSense.exe'
      - '\SenseCncProxy.exe'
      - '\MpDefenderCoreService.exe'
  condition: selection and not filter_legitimate
falsepositives:
  - New EDR software installation
  - Windows Update modifying provider registrations
level: high
tags:
  - attack.defense_evasion
  - attack.t1562.006
  - volt_typhoon
  - apt44

Mitigation Recommendations

Microsoft has been notified of this technique under responsible disclosure (Case #MSRC-2026-0177, submitted Jan 14, 2026). A patch addressing the ETW session priority behavior is expected in the Q2 2026 Patch Tuesday cycle. Until then, we recommend the following:

✓ IMMEDIATE MITIGATIONS

1. Deploy the Sigma rule above to your SIEM immediately. It will catch the registry artifact that exists for ~200ms during provider registration — short, but detectable with high-fidelity event log collection.

2. Enable Windows ETW session auditing via Group Policy (Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy → System → Audit Security System Extension).

3. Ensure all perimeter VPN appliances are patched — this group exclusively enters via edge devices. No patch, no entry point.

4. SentinelPRO IA customers running platform v4.1+ have this detection rule deployed automatically as of March 7, 2026 at 14:22 UTC.

ℹ SENTINELPRO IA DETECTION COVERAGE

The Threat Engine module in SentinelPRO IA v4.1+ detects ETW provider GUID collisions using kernel-level telemetry that bypasses the suppression mechanism. The Attack Surface Monitor module will additionally flag unpatched perimeter VPN appliances matching known Volt Typhoon entry vectors. Both detections are deployed automatically — no rule update required.

Attribution Confidence

We assess with high confidence (80%+) that this activity is attributable to Volt Typhoon / APT44 based on: TTP overlap with previously published Microsoft and CISA advisories, infrastructure reuse (two C2 IPs overlap with previously attributed Volt Typhoon campaigns from 2024), targeting of OT-adjacent Windows hosts in critical infrastructure environments, and the extreme LOTL discipline consistent with this group's documented operational security posture.

⚠ DISCLOSURE TIMELINE

Nov 14, 2025 — First anomaly detected in customer telemetry
Dec 3, 2025 — Root cause identified as ETW GUID collision
Jan 14, 2026 — Microsoft MSRC notified (Case #MSRC-2026-0177)
Feb 28, 2026 — Microsoft confirms vulnerability, patch planned for Q2 2026
March 7, 2026 — Public disclosure, detection rule deployed to all SentinelPRO IA customers

Marcus Reyes

Senior Threat Researcher · SentinelPRO IA Labs

Marcus has 12 years of experience in threat intelligence and adversary tracking, with prior roles at CISA and a major US defense contractor. He leads the APT tracking program at SentinelPRO IA Labs, with a focus on state-sponsored threat actors operating against critical infrastructure. He holds OSCP, GREM, and GCFA certifications.