CHINA · APT
CRITICAL THREAT
VOLT TYPHOON
Attribution: People's Republic of China · Posture: Pre-positioned in US Critical Infrastructure
Composite ATQ
▲ +2.3
90d
78.6
/ 100
Twelve-Dimension Decomposition
(materialized view: seldon.seldon_score_v2)
Sum: 78.5/100
TACAM Physical Affinity Cross-Match
77,279 Knowledge Graph Edges
Critical Infrastructure Sector Affinity
OT/ICS Protocol Vulnerabilities
Primary CPE Hardware Targets
MITRE ATT&CK Kill Chain Execution (12/14 Tactics Present)
Inactive: Exfiltration, Impact
* Note: Volt Typhoon deliberately foregoes exfiltration and destruction during pre-positioning, optimizing for persistent living-off-the-land access.
90-Day Trajectory Regression
Epoch 228 → 234 (+2.3 pts)
Statistical Confidence: 87%
Empirical Delta Drivers
+1.4
Temporal
+0.6
EPSS vel
+0.3
Recency
Simulation Parameter: Boltzmann Walk Multiplier: 1.48x
EIGENIA-WG07-TM-03: Canonical Telemetry Output
┌──────────────────────────────────────────────────────────┐ │ VOLT TYPHOON ATQ: 78.6 │ │ Attribution: China / People's Republic of China │ │ Sophistication: Advanced Persistent Threat │ ├──────────────────────────────────────────────────────────┤ │ COMPONENT BREAKDOWN │ │ │ │ ████████████████░░░░ EIC Score (18%) ▸ 14.7/18 │ │ ██████████████░░░░░░ Kill Chain (14%) ▸ 12.0/14 │ │ █████████████░░░░░░░ Temporal (13%) ▸ 12.4/13 │ │ ████████░░░░░░░░░░░░ EPSS Base (10%) ▸ 7.3/10 │ │ ████████░░░░░░░░░░░░ Technique Reach (10%) ▸ 6.8/10 │ │ ████████░░░░░░░░░░░░ Vendor Exposure (10%) ▸ 8.0/10 │ │ ████░░░░░░░░░░░░░░░░ Sector Reach (5%) ▸ 4.2/ 5 │ │ ███░░░░░░░░░░░░░░░░░ Protocol Reach (5%) ▸ 3.4/ 5 │ │ ████░░░░░░░░░░░░░░░░ Incident Count (5%) ▸ 4.2/ 5 │ │ ████░░░░░░░░░░░░░░░░ Campaign Recency (5%) ▸ 4.8/ 5 │ │ ██░░░░░░░░░░░░░░░░░░ EPSS Velocity (5%) ▸ 0.4/ 5 │ │ ██░░░░░░░░░░░░░░░░░░ Geo Tension (5%) ▸ 0.3/ 5 │ ├──────────────────────────────────────────────────────────┤ │ TACAM CROSS-MATCH │ │ Sector: Energy (0.94), Water (0.71), Comms (0.83) │ │ Protocols: OPC-UA, Modbus, DNP3 │ │ Top CPE Targets: Siemens SIMATIC, Cisco IOS, Fortinet │ │ Campaign Recency: Active (last 30 days) │ │ Kill Chain: 12/14 tactics (missing: Exfiltration, Impact)│ ├──────────────────────────────────────────────────────────┤ │ TRAJECTORY (90-DAY) │ │ ATQ Δ: +2.3 points ↑ (Epoch 228 → 234) │ │ Driven by: Temporal +1.4, EPSS vel +0.6, Recency +0.3 │ │ Forecast: Elevated through Q3 2026 (87% confidence) │ └──────────────────────────────────────────────────────────┘
Governing Formulation: Twelve-Weight Linear Convex Combination
$$\text{ATQ}_a(t) = \sum_{k=1}^{12} w_k \cdot \sigma_k\left( x_{a,k}(t) \right) \times 100 \quad \text{where} \quad \sum_{k=1}^{12} w_k = 1.0$$
Downstream Stochastic Boltzmann Coupling
$$P(u \to v \mid a) = \frac{\exp\left( -\frac{\Delta E(u, v)}{k_B \cdot \mathcal{T}_{\text{eff}}(a)} \right)}{\sum_{w \in \mathcal{N}(u)} \exp\left( -\frac{\Delta E(u, w)}{k_B \cdot \mathcal{T}_{\text{eff}}(a)} \right)}, \quad \mathcal{T}_{\text{eff}}(a) = \mathcal{T}_0 \left( \frac{\text{ATQ}_a}{100} \right)^{\gamma} \prod_s \mu_s(a)$$
| # | Dimension | Weight | Threshold ($\theta_k$) | Authoritative Data Feed |
|---|
Formal Academic Specification Citation
@techreport{mckenney2026atq,
author = {McKenney, J.},
title = {Adversary Threat Quotient (ATQ): A Twelve-Factor Quantitative Threat Actor Scoring Model},
institution = {Eigenia Research Laboratories},
number = {EIGENIA-WG07-TM-03},
series = {Threat Modeling and Cyber-Physical Hazard Analysis},
year = {2026},
month = {April},
address = {Amsterdam, Netherlands},
url = {https://eigenia.nl/papers/atq-deep-dive},
note = {Normative Standards: IEC 62443-3-2, ISO 15926, FIRST EPSS v3, Lloyd's Y5381}
}
Dimension Telemetry
ACTIVE INSPECT
Selected Metric
EIC Score
Audited Points
14.7 / 18.0 pts
Relative Weight
18% of Total
Saturation Ratio ($\sigma_k$)
81.7% Saturation
Mathematical Saturation Rule
PERCENT_RANK() across 178 profiled threat groups
Authoritative Data Feed
seldon.actor_eic (178 profiled actors)
Operational Significance
Base threat actor assessment quantifying Intent, Capability, and Opportunity.