Volt Typhoon: T1070.003 Indicator Removal Emulation

Understanding adversary tactics is crucial for cybersecurity. Attackers often employ indicator removal as a key technique to evade detection. This involves deleting files – like tools and malware used during an attack – that could reveal their activities and methods. This course, Volt Typhoon: T1070.003 Indicator Removal Emulation, dives deep into how the sophisticated Volt Typhoon threat group utilizes this tactic.

Learn how adversaries attempt to minimize their digital footprint within systems, particularly within critical infrastructure. We'll examine how indicator removal is used both during an initial intrusion and as part of ongoing post-intrusion activities to maintain stealth. This course provides valuable insights into a real-world example of how a threat actor successfully operated undetected for an extended period – over 5 years – by effectively removing evidence of their presence. By understanding this technique, you can better defend against similar attacks and improve your organization's overall security posture. This training focuses on T1070.003, a specific technique within the MITRE ATT&CK framework.