PRC APT/Typhoon Label Crosswalk And Advisory Refresh Source Packet

UNCLASSIFIED//OPEN SOURCE

Source Packet ID: WI-SOURCEPACKET-PRC-APT-TYPHOON-2026-0001

Prepared UTC: 2026-06-18T12:13:59Z

Information cutoff UTC: 2026-06-18T12:13:59Z

Source base: FBI China cyber threat overview and dated FBI cyber alerts; DOJ January 31, 2024 Volt Typhoon / KV Botnet disruption release; DOJ March 5, 2025 i-Soon / APT27 charging release; Treasury January 17, 2025 Salt Typhoon sanctions release; OFAC cyber-related sanctions source route; CISA, NSA, FBI, FCC, State Rewards for Justice, and allied cyber-center source families; existing WARLOCK-INDEX PRC cyber and critical-infrastructure defensive source packet, Salt Typhoon telecommunications defensive source note, China/PLA source tracker, cyber nation-state actor/APT tracker, official threat-source tracker, source registers, coverage map, and global actor-domain assimilation matrix.

Analytic confidence: High for the accessible FBI, DOJ, and Treasury page identities and for source-class separation. Moderate for exact CISA, NSA, FCC, and allied advisory page-level extraction because some direct advisory routes remain access-caveated or dynamic in this environment. Low for any claim that would merge private-sector aliases, vendor labels, or technical behavior into official attribution without a dated source-class note.

Purpose: Create a safe PRC APT/Typhoon label crosswalk that records which public source uses which label, what source class supports it, and how later WARLOCK-INDEX products should route PRC cyber actor language without reproducing technical tradecraft.

Boundary: Strategic defensive source organization only. This packet does not provide exploit steps, commands, indicators, vulnerability lists, malware behavior, device guidance, scanning procedures, credential methods, lawful-intercept detail, provider-specific security findings, victim lists, network diagrams, sanctions-evasion guidance, investigative direction, or operational cyber guidance.

Bottom Line

PRC cyber labels should be treated as dated source labels, not as a single normalized alias encyclopedia. The accessible official record in this pass supports a controlled crosswalk across several label families:

1. FBI's China cyber overview is the source hub for PRC cyber warning chronology and dated FBI alerts.
2. FBI and Treasury both support a Salt Typhoon source lane, but the FBI source route, Treasury sanctions source route, Senate oversight route, and CISA/NSA/FBI advisory route have different evidentiary roles.
3. DOJ's January 31, 2024 disruption release carries Volt Typhoon as a private-sector label in a law-enforcement source event and should remain tied to that source class.
4. DOJ's March 5, 2025 i-Soon charging release supports APT27 and a DOJ-listed private-sector alias lane for that case, but allegations, company links, and aliases should not be generalized beyond the source.
5. FBI alert titles support additional PRC source routes, including APT40, PRC-linked router/IoT activity, BADBAZAAR and MOONSHINE, and broader Chinese state-sponsored actor warning language, without copying technical content into WARLOCK-INDEX.

The next PRC cyber work should refresh exact CISA, NSA, FBI, FCC, and allied advisory pages where access allows, but this packet is enough to stop broader products from laundering APT labels into unqualified attribution.

Source Ledger

Label Crosswalk

Extraction Rules

1. Extract publisher, title, date, access date, source class, issuing agencies, actor label exactly as written, and high-level sector lane.
2. Treat Typhoon, APT, actor, activity, company, and private-sector aliases as source labels until a dated source packet states who used the label.
3. Keep legal actions, sanctions/designations, rewards, advisories, oversight, intelligence assessments, and allied warnings in separate source classes.
4. Do not copy commands, indicators, exploit chains, hashes, domains, vulnerable products, device models, malware behavior, detection signatures, configuration steps, or incident-response procedures.
5. Do not construct victim, provider, facility, or private-person dossiers. Name entities only when a public DOJ, Treasury, OFAC, or court source makes the reference necessary for strategic source routing.
6. Do not convert Senate, FCC, Treasury, or Rewards for Justice material into proof of technical remediation status, active access, victim count, or provider security posture.
7. Preserve uncertainty when official pages use broad language such as "linked," "affiliated," "state-sponsored," "contract hacker," or "activity."

PRC Cyber Label Routing

Follow-On Queue

Information Gaps

• CISA, NSA, FCC, and some allied advisory pages still require page-level direct refresh before exact titles, agency lists, and advisory metadata are considered complete.
• FBI pages are accessible as routes in this pass, but some linked PDF content requires separate extraction controls before stronger claim-level use.
• Public sources do not prove full alias equivalence, complete actor tasking, current access, remediation status, victim counts, or classified attribution.
• Treasury cross-references to Flax Typhoon and APT31 require their own direct designation/legal-action refreshes before those labels are expanded.
• Commercial threat-intelligence labels remain outside the corpus unless a future commercial/research source-class rule admits them with explicit source treatment.

Cross References

• PRC Cyber And Critical Infrastructure Defensive Source Packet
• Salt Typhoon And Telecommunications Defensive Source Note
• China/PLA Source Collection Tracker
• Cyber Nation-State Actor And APT Source Tracker
• Official Threat Source Collection Tracker
• Official U.S. Intelligence And Law Enforcement Source Register
• Official U.S. Source Register
• Allied And Multilateral Source Register
• Coverage Map
• Global Actor-Domain Assimilation Matrix
• Global Cyber And Critical Infrastructure Strategic Baseline

Source Base

• FBI, Cyber Threat Overview: China: https://www.fbi.gov/investigate/cyber/cyber-threat-overview-china
• FBI, Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System: https://www.fbi.gov/investigate/cyber/alerts/2025/countering-chinese-state-sponsored-actors-compromise-of-networks-worldwide-to-feed-global-espionage-system
• FBI, People's Republic of China Cyberthreat Activity: https://www.fbi.gov/investigate/cyber/alerts/2025/peoples-republic-of-china-cyber-threat-activity
• FBI, FBI Seeking Tips About PRC Targeting of U.S. Telecommunications: https://www.fbi.gov/investigate/cyber/alerts/2025/fbi-seeking-tips-about-prc-targeting-of-us-telecommunications
• FBI, BADBAZAAR and MOONSHINE Spyware Targeting Uyghur, Taiwanese, and Tibetan Groups and Civil Society Actors: https://www.fbi.gov/investigate/cyber/alerts/2025/badbazaar-and-moonshine-spyware-targeting-uyghur-taiwanese-and-tibetan-groups-and-civil-society-actors
• FBI, Beijing Leveraging Freelance Hackers and Information Security Companies to Compromise Computer Networks Worldwide: https://www.fbi.gov/investigate/cyber/alerts/2025/beijing-leveraging-freelance-hackers-and-information-security-companies-to-compromise-computer-networks-worldwide
• FBI, Enhanced Visibility and Hardening Guidance for Communications Infrastructure: https://www.fbi.gov/investigate/cyber/alerts/2024/enhanced-visibility-and-hardening-guidance-for-communications-infrastructure
• FBI, People's Republic of China-Linked Actors Compromise Routers and IoT Devices for Botnet Operations: https://www.fbi.gov/investigate/cyber/alerts/2024/peoples-republic-of-china-linked-actors-compromise-routers-and-iot-devices-for-botnet-operations
• FBI, APT40 Advisory: PRC MSS Tradecraft in Action: https://www.fbi.gov/investigate/cyber/alerts/2024/apt40-advisory-prc-mss-tradecraft-in-action
• FBI, PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure: https://www.fbi.gov/investigate/cyber/alerts/2024/prc-state-sponsored-actors-compromise-and-maintain-persistent-access-to-u-s-critical-infrastructure
• FBI, Malicious Cyber Actors Exploiting Insecure SOHO Routers: https://www.fbi.gov/investigate/cyber/alerts/2024/malicious-cyber-actors-exploiting-insecure-soho-routers
• U.S. Department of Justice, U.S. Government Disrupts Botnet People's Republic of China Used to Conceal Hacking of Critical Infrastructure: https://www.justice.gov/archives/opa/pr/us-government-disrupts-botnet-peoples-republic-china-used-conceal-hacking-critical
• U.S. Department of Justice, Justice Department Charges 12 Chinese Contract Hackers and Law Enforcement Officers in Global Computer Intrusion Campaigns: https://www.justice.gov/opa/pr/justice-department-charges-12-chinese-contract-hackers-and-law-enforcement-officers-global
• U.S. Department of the Treasury, Treasury Sanctions Company Associated with Salt Typhoon and Hacker Associated with Treasury Compromise: https://home.treasury.gov/news/press-releases/jy2792
• OFAC, cyber-related sanctions source route: https://ofac.treasury.gov/sanctions-programs-and-country-information/sanctions-related-to-significant-malicious-cyber-enabled-activities
• CISA, cybersecurity advisories source family: https://www.cisa.gov/news-events/cybersecurity-advisories
• NSA, cybersecurity advisories and guidance source family: https://www.nsa.gov/Press-Room/Cybersecurity-Advisories-Guidance/
• State Department Rewards for Justice, Foreign Malicious Cyber Activity Against U.S. Critical Infrastructure: https://rewardsforjustice.net/rewards/foreign-malicious-cyber-activity-against-u-s-critical-infrastructure/