From Vietnam to Volt Typhoon

The foundational study of the practice. This paper traces a through-line from PRC-linked cyber operations incubated across Vietnam and ASEAN to the pre-positioning campaigns now confronting Western critical infrastructure, arguing that the most important patterns sit between the silos that conventional monitoring maintains. Drawing exclusively on open sources cross-referenced against The Observatory’s cross-sector incident record, it established the incubation-to-infrastructure model that now underwrites EWSRC research. Cited by the UK National Cyber Security Centre’s Office of the CTO and syndicated across four continents.

• 01Capability development follows a legible geography, from regional proving grounds in Southeast Asia to Western targets.
• 02Cross-sector movement is the signature of a maturing campaign, not a coincidence of victims.
• 03Open-source evidence, properly structured, is sufficient to see the pattern before public attribution.

This page is the canonical version of record. The paper is also available on an external platform:

• SSRN — full paper