Volt Typhoon

Sprawling Chinese cyber-espionage / prepositioning campaign named for its goal of burrowing into American critical infrastructure to prepare for sabotage (rather than for immediate espionage). Per the 2026-08-22 Economist piece:

"A sprawling Chinese campaign, known as Volt Typhoon, has sought to burrow into American critical infrastructure to prepare for sabotage."

The vault frame: strategic threat behind the tactical threat

The 2026-08-22 Economist water-utility hack piece pairs Volt Typhoon with Iran-affiliated cyber operations in a way that clarifies the two-body structure of the current threat model:

Iran (2026 attacks on Minnesota + Georgia water utilities + earlier NY dam + Oldsmar Florida) — tactical attacks, opportunistic, correlated with the Iran War (2026) retaliation cycle.
Volt Typhoon (China) — strategic preposition, aiming at the "turn out the lights" option in a Taiwan-crisis scenario, not immediate disruption.

Iran is doing what China has been preparing to do. The Iranian attacks demonstrate that the capability to disrupt US critical infrastructure — water, power, water-treatment control systems — is broadly available; Volt Typhoon is the most patient, most-embedded, and most-consequential actor in the same space.

Why this page exists

First named-in-vault — despite being a well-known Western-intelligence-community concept for several years, Volt Typhoon hasn't appeared in a vault source until now. Deserves its own page as an anchor for the China-preposition-for-critical-infrastructure-sabotage thread that the vault expects to compound.
Anchor for the CISO / critical-infrastructure thread — the vault's Autonomous AI Cyberattack page tracks the AI-agent-attack dimension; Volt Typhoon tracks the human-directed nation-state dimension. Both should compound.
Anchor for the Taiwan-scenario planning — Volt Typhoon is one of the "if China moves on Taiwan, what happens at home" dimensions that any strategic-planning vault page needs.

Connects to

Why the Worlds Richest Country Cant Defend Vital Infrastructure (Economist) — the source that anchors this page.
Autonomous AI Cyberattack — the AI-agent-attack dimension of critical-infra threat; Volt Typhoon is the human-directed dimension.
Iran War (2026) — the retaliation cycle producing the Iran-affiliated tactical attacks that demonstrate the capability Volt Typhoon has been positioning to exploit.
TSMC — the Taiwan-scenario umbrella that gives Volt Typhoon its strategic purpose.
Sovereign AI — the underlying question of what infrastructure a country can afford to have foreign-embedded is the same on the AI side and the OT/critical-infra side.
Hierarchy of Access — the asymmetric-preposition pattern: attackers embed in advance, defenders respond after the fact.

Follow-ups

Second-touch trigger: a second vault source substantively naming Volt Typhoon or a similar Chinese prepositioning campaign (Salt Typhoon, Flax Typhoon, Silk Typhoon) will earn either an expanded page here or a new "Typhoon Family" concept page.
CISA (Cybersecurity and Infrastructure Security Agency) — first substantive named in this ingest; the "CISA in disarray" line from the same source is the load-bearing 2026-H2 CISO scenario input.