Volt Typhoon Intrusion at Littleton Electric Light and Water (2023)
Volume 2Energy edition2023Last verified 10 sources, 4 primaryVolt Typhoon, per the FBI's notification
For months in 2023, intruders sat in a small Massachusetts utility’s network. No primary source places them in its control systems. They went for the files that describe them, the work that comes before an attack.
Nothing on the record reached a breaker, a pump or a controller. The utility says the intruders appeared to reach a file server of public records; Dragos’s case study places the activity “close to the utility’s OT.” Adjacency versus access is the entry, and most retellings, our own candidate list included, collapsed it.
Collapsing it is the error, and so is shrugging it off. What Dragos told reporters the group was aiming at is the paperwork of the grid: operating procedures and spatial layout data. None of that moves a valve. All of it shortens the distance between a foothold and an effect. In BlastWave’s analysis, that makes the documentation part of the OT attack surface. The utility answered it, changing its architecture “to render unusable any system information potentially obtained by the hackers.” You cannot recall a map. You can make it wrong.
What is not known: When it began is the vendor’s reconstruction: Dragos told reporters February 2023 and more than 300 days, figures absent from its own case study. Who detected it first is told several ways: the utility says the FBI told it, a trade article says new sensors helped confirm the extent, and the case study says those sensors were rushed in afterwards. No utility document lists the files that left. The federal advisory names no victim. The utility has disclosed no cost. Whether anything taken would help a later attack on the grid cannot be known from outside.
Recommendation
Take the path away at the edge Nothing internet-facing, least of all a firewall’s own management and VPN interfaces, should answer anyone who has not already proved who they are.
Remove standing credential-based access This group uses valid accounts and built-in tools. Access to anything reaching toward OT, engineering and GIS servers too, is bound to a verified identity per session.
Make the business side read one way Maps and reports flow out of the operational side one way, with no path back toward the field. After a compromise, change the ground so what was taken no longer matches.
Sources: LELWD statement, 14 Mar 2025; Dragos Littleton case study, Mar 2025; Dragos VOLTZITE hunt blog, 10 Apr 2024; CISA AA24-038A, 7 Feb 2024, updated 7 Mar 2024; APPA, 8 Nov 2024; The Register, 12 Mar 2025. Full list with links.
Soft Spots: 300 days and a February 2023 start are Dragos to reporters, not its case study. The April 2024 Dragos blog does not name Littleton. Documentation as OT attack surface is BlastWave’s analysis, not a disclosed fact.
The full record
Every claim numbered to its source. Last updated .
For months in 2023, intruders sat in a small Massachusetts utility's network, and no primary source places them in its control systems. What is verified, what is only reported, and what is still unknown.
Summary
In 2023, intruders the FBI identified to the utility as Volt Typhoon were in the IT network of Littleton Electric Light and Water Departments, a small Massachusetts public power and water utility. The FBI notified it in November 2023; the intruders were out by December. No primary source places them in its control systems; when the intrusion began is disputed.
Timeline of the Littleton intrusion
Every date is tied to a source. Press reporting appears only as evidence of what was said.
Fortinet patches the flaw in the firewall model the utility used, according to The Register's account.6
Dragos later tells reporters the intrusion began this month. The date is not in Dragos's own published case study.2,7,8
Dragos sensors go onto the utility's OT network and spot traffic communicating with China, as The Register reports it. Other accounts order the sensors and the FBI call differently.6
The FBI tells the utility that Volt Typhoon has access to its system.1The trade and press accounts place the call on the Friday afternoon the week before Thanksgiving; they differ on whether the general manager or the assistant general manager took it.5,6,8
Federal officials arrive at the utility, according to The Register.6
By the utility's account, the federal government and the intruders are off the system.1
CISA, NSA, FBI and partners publish advisory AA24-038A on Volt Typhoon (updated 7 March 2024). It names no victim.4
Dragos publishes a threat hunting blog on a late 2023 hunt at a customer it does not name.3
CISA returns for a two-week penetration test that, in the utility's words, showed the defenses working properly.1
The American Public Power Association publishes the utility's account of the call and the sensors.5
The general manager's interview with The Register is published. Dragos gives SecurityWeek and The Record a February 2023 start and, to SecurityWeek, a figure of more than 300 days.6,7,8
Dragos publishes its Littleton case study. The utility publishes its own statement on 14 March 2025.1,2
CBS's 60 Minutes broadcasts a segment on Chinese intrusions into US infrastructure that features Littleton.9,10
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
Question
What the record says
Status
Who told the utility?
The FBI, in November 2023, by the utility's account1
Verified
What did the intruders reach?
"It appeared the hackers accessed a file server that stores public records." No customer-sensitive data1
Verified (utility's hedge)
Were the control systems reached?
Not shown in any primary source. Dragos places the activity "close to the utility's OT"1,2,6
Verified (time-bound)
How did they get in?
A firewall with a known flaw whose firmware the then managed service provider had not updated1
Verified
Which firewall and which flaw?
FortiGate 300D, per the general manager to The Register. No CVE on any primary record6
Reported only
Who was the intruder?
Volt Typhoon, per the FBI as the utility reports it; Dragos's VOLTZITE "overlaps with Volt Typhoon"1,2
Undisclosed by the utility. "More than $50,000" is broadcast narration only9
Undisclosed
Did Volt Typhoon get into Littleton's grid or water controls?
No primary source places the intruders in the utility's control systems, its substation or its water treatment. Every primary source declines the phrase "inside the OT network." The utility's statement keeps its own hedge:
"While in the system, it appeared the hackers accessed a file server that stores public records."
"I wouldn't say anything related to our substation or our engineering was compromised."
Dragos, the vendor that worked the case, writes in its published case study that its team identified the group's actions "close to the utility's OT."2 That phrase is not a statement that the group was outside OT, and it is not a statement that it was inside. It is the vendor declining to say "in."
A Dragos threat hunting blog from April 2024 describes a late 2023 hunt at a customer it does not name. It found "no evidence of adversary access to assets within the OT environment."3 The match with Littleton in timing and technique is BlastWave's reading; the blog does not name the utility.
The accurate summary is time-bound: as of late September 2026, nobody has shown the intruders reached the control systems. That is not the same as proof they could not have.
How did the intruders get into Littleton's network?
Through a firewall with a known flaw that the utility's then managed service provider had not patched. The utility says it was targeted because its system used a firewall with a known security flaw, and that the provider had not updated the firmware and was terminated.1
The general manager told The Register the device was a FortiGate 300D, and The Register reports the patch had been available since December 2022.6 Neither the utility nor Dragos has published a CVE, so the specific flaw is not identified in any primary document.
Once inside, Dragos describes server message block traversal and remote desktop lateral movement.2 The federal advisory on this group describes reliance on valid credentials and built-in tools rather than malware, across its victims.4
Who was behind the Littleton utility intrusion?
The name comes from the FBI's notification, as the utility reports it, and from Dragos; no government document names this utility. The utility says the FBI told it in November 2023 that "a Chinese cyberespionage group, Volt Typhoon" had access to its system.1 Dragos tracks the activity as VOLTZITE, which it says "overlaps with Volt Typhoon."2
Advisory AA24-038A, published by CISA, NSA, FBI and partners on 7 February 2024 and updated 7 March 2024, assesses Volt Typhoon as a People's Republic of China (PRC) state-sponsored actor. Its high confidence attaches to the judgement that Volt Typhoon actors are pre-positioning on IT networks to enable lateral movement to OT assets. AA24-038A lists Voltzite among Volt Typhoon's aliases; it names no victim, so the alias carries nothing to Littleton.4
Each link is stated here as what it is: the victim's account of the FBI, a vendor's overlap assessment, and a federal advisory about the group in general. Together they do not amount to a published US government attribution of this intrusion.
How long was Volt Typhoon in the Littleton network, and who found it?
The start date and the day count are the vendor's reconstruction, given to reporters, and the discovery is told four ways. Dragos told SecurityWeek in March 2025 that the intruders had been in the network since February 2023, for more than 300 days; The Record reported the February 2023 start.7,8 Neither figure appears in Dragos's own published case study.2
The figures also fail on their own dates. BlastWave's arithmetic, not a disclosed fact: 1 February to 17 November 2023 is 289 days, so "more than 300" clears only if counted to eviction in December rather than to discovery. February is given without a day, so this is an upper bound on the count to discovery.
Who detected it first is unsettled:
The utility: the FBI told it, and it then worked with CISA to install sensors to monitor the hackers.1
The Register: Dragos sensors installed on the OT network in August 2023 spotted traffic communicating with China.6
The American Public Power Association: sensors went in about a month or two before the call and helped confirm the extent of the activity.5
Dragos's case study: the utility was "prompted to deploy quickly and bypass the planned onboarding timeline."2
Who took the FBI's call also differs: the general manager in the APPA article and The Register, the assistant general manager in The Record.5,6,8
What were the intruders after?
The paperwork of the grid, by the vendor's account, though no utility document lists files that left. Dragos told SecurityWeek the group was "seen collecting data on OT systems" and was "aiming to exfiltrate specific data related to OT operating procedures and spatial layout data."7 "Aiming" is an intent word, not an inventory.
The April 2024 Dragos blog on the matching unnamed customer says the group had exfiltrated GIS server data from the IT network and showed a focus on SCADA-related information.3 That finding belongs to the unnamed customer; tying it to Littleton is BlastWave's reading.
The federal advisory describes the same appetite at other victims, down to diagrams of relays and switchgear.4 Those diagrams are other victims' losses, not a list of what left Littleton.
What is still not known about Volt Typhoon / Littleton
When the intrusion began. February 2023 is Dragos speaking to reporters and is absent from its own case study.2,7,8
Whether "more than 300 days" was counted to discovery or to eviction.7
Who detected it first: the FBI, the newly installed sensors, or both. Four accounts are on the record and none reconciles them.1,2,5,6
Who took the FBI's call: the general manager or the assistant general manager.5,6,8
Which files, if any, left the network. No utility document lists them.
Which firewall flaw was used. No CVE appears in any primary record.
Whether the unnamed customer in Dragos's April 2024 blog is Littleton.3
The cost of the incident. The utility has disclosed none.
Whether anything taken would help a later attack on the grid. That cannot be known from outside.
Claims about Volt Typhoon / Littleton the record does not support
Widely repeated claim
What the record says
SecurityWeek, March 2025, reporting Dragos: "the hackers had been in the organization's network since February 2023, for more than 300 days."
Dragos speaking to reporters, not its published case study. On Dragos's own dates, a February start and a November discovery, the count comes to at most 289 days, short of 300 unless counted to eviction in December.2,7,8
60 Minutes, October 2025: the water plant's "tanks of dangerous chemicals" shown alongside the Littleton intrusion and a five-year dwell figure.
The broadcast set the treatment plant's chemical tanks beside the intrusion and beside a five-year dwell figure the federal advisory gives for other victims. No document places the intruders anywhere near water treatment control.4,9
60 Minutes, October 2025: rebuilding the network cost "more than $50,000."
The figure appears only in the October 2025 broadcast narration. The utility has disclosed no cost.1,9
Dragos sensors caught the intruders (the substance of The Register's March 2025 account: sensors installed in August 2023 spotted communications with China).
One of four accounts. The utility says the FBI told it; the APPA article says the sensors helped confirm the extent; the case study says deployment was expedited after.1,2,5,6
How did the Littleton utility respond?
It checked the call, contained the intruders, changed its network so stolen information would not match, and published its account under its own name. By The Register's account, the general manager took the agent's name and called the FBI's Boston office himself to confirm the call was genuine.6 The utility says it cooperated with CISA to install sensors, and that the intruders were off the system by December 2023.1
The single most instructive fact on the record: the utility says its network architecture "was changed to render unusable any system information potentially obtained by the hackers."1 It terminated the managed service provider that had not updated the firewall.1 OT sensors were already going in under a cooperative agreement between the American Public Power Association and the Department of Energy.5
In August 2024, CISA returned for a two-week penetration test that, in the utility's words, showed the cybersecurity defenses working properly.1
BlastWave analysis: close to is not in, and you cannot recall a map
Analysis, not a disclosed fact
Nothing on the record reached a breaker, a pump or a controller, and adjacency versus access is the whole entry. Collapsing it into "inside the OT network" is one error; shrugging it off as "only a file server" is the other. What Dragos told reporters the group was aiming at is the paperwork of the grid: operating procedures and spatial layout data; the matching hunt adds GIS and SCADA-related data. None of that moves a valve. All of it shortens the distance between a foothold and an effect, and the advisory's own high-confidence judgement is that this activity is pre-positioning.3,4,7 That makes the documentation part of the OT attack surface, wherever it is stored. That sentence is BlastWave's analysis, not a disclosed fact, and so is the identification of Dragos's unnamed customer with Littleton.
The utility comes out of this well, and the record shows why. Its general manager checked the FBI's call rather than trusting it, OT sensors were already going in under a public power program, and the utility published its account under its own name. It also did the one thing that answers stolen documentation: it changed its network architecture "to render unusable any system information potentially obtained by the hackers."1,5,6 You cannot recall a map. You can make it wrong.
Podcast: “The Film Room” (9:17). Joe Baxter and Cam Cullen on why the paperwork that describes a plant is part of what an attacker needs, and why this utility comes out of it well.
Video: Volt Typhoon / Littleton Short (60 to 90 seconds).
Frequently asked questions
What happened at Littleton Electric Light and Water Departments?
In November 2023 the FBI told Littleton Electric Light and Water Departments, a small Massachusetts public power and water utility, that a Chinese cyberespionage group, Volt Typhoon, had access to its system, according to the utility's statement of 14 March 2025. The utility says the intruders appeared to reach a file server that stores public records, and that they were off the system by December 2023.
Did Volt Typhoon hack Littleton's power grid or water treatment controls?
No primary source says so. The utility says it appeared the intruders accessed a file server that stores public records, and its general manager told The Register in March 2025 that he would not say anything related to the substation or engineering was compromised. Dragos's case study places the activity close to the utility's OT. As of late September 2026, nobody has shown the intruders reached the control systems.
How long was Volt Typhoon inside the Littleton utility's network?
No primary document says. Dragos told SecurityWeek in March 2025 that the intrusion began in February 2023 and lasted more than 300 days, but neither figure appears in Dragos's own published case study. By BlastWave's arithmetic on those dates, a February start to the November 2023 FBI notification is at most 289 days, so the 300-day figure works only if counted to the intruders' removal in December 2023.
Did the US government attribute the Littleton intrusion to China?
No government document names the utility. The Volt Typhoon name comes from the FBI's notification as the utility reports it, and from Dragos, which tracks the activity as VOLTZITE and says it overlaps with Volt Typhoon. Advisory AA24-038A, published by CISA, NSA, FBI and partners in February 2024, assesses Volt Typhoon as a PRC state-sponsored actor but names no victim.
How did the hackers get into the Littleton utility?
The utility says it was targeted because its system used a firewall with a known security flaw, and that its then managed service provider had not updated the firmware and was terminated. The general manager told The Register in March 2025 the device was a FortiGate 300D. Neither the utility nor Dragos has published a CVE. Dragos describes server message block traversal and remote desktop lateral movement once inside.
What did the hackers take from Littleton?
The utility has not listed any files taken. Dragos told reporters in March 2025 that the group was aiming to exfiltrate data related to OT operating procedures and spatial layout. A Dragos blog from April 2024 on an unnamed customer, which BlastWave reads as matching this case, says GIS server data was exfiltrated from the IT network. The utility says no customer-sensitive data was compromised.
Did the 60 Minutes report show Littleton's water was at risk?
No document places the intruders near water treatment control. The 60 Minutes segment broadcast on 12 October 2025 showed the treatment plant's chemical tanks and cited a five-year dwell figure that the federal advisory gives for other victims, not for Littleton. Its figure of more than $50,000 to rebuild the network appears only in the broadcast narration; the utility has disclosed no cost.
How did Littleton Electric Light and Water respond to the intrusion?
The utility says it cooperated with CISA to install sensors, that the intruders were off the system by December 2023, and that its network architecture was changed to render unusable any system information the hackers may have obtained. It terminated its managed service provider. In August 2024 CISA returned for a two-week penetration test that, the utility says, showed its defenses working properly.
Primary sources are the utility's own dated statement, the joint federal advisory on Volt Typhoon, and the published case study and threat hunting blog of the vendor that worked the case. Interviews are cited for the utility officials' own words; other press is cited only as evidence of what was said.
CompanyLittleton Electric Light and Water Departments, "LELWD Publicizes Case Study on Foreign Hackers Targeting U.S. Utilities," statement, 14 March 2025. lelwd.com · Statement (PDF)
ResearcherDragos, "Hunting Active Threats in Littleton's Grid with the Dragos Platform and OT Watch," case study, March 2025. PDF
ResearcherDragos, John Burns and Caitlin Sullivan, "The Hunt: Detecting VOLTZITE Threat Group Activity in Critical Infrastructure," 10 April 2024. Describes an unnamed customer. dragos.com
FederalCISA, NSA, FBI and partners, Joint Cybersecurity Advisory AA24-038A, "PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure," 7 February 2024, updated 7 March 2024. cisa.gov · Advisory (PDF)
PressAmerican Public Power Association, Susan Partain, "Cybersecurity Wake-Up Call: Lessons from an Attack on a Small Utility," 8 November 2024. Trade association article; cited for the utility's account as told to it. publicpower.org
PressThe Register, Jessica Lyons, interview with Nick Lawler, general manager, 12 March 2025. Cited for the general manager's own words; narration is evidence of what was said. theregister.com
PressSecurityWeek, Eduard Kovacs, report on Dragos's Littleton findings, 12 March 2025. Evidence of what Dragos told reporters, not of what happened. securityweek.com
PressThe Record, Jonathan Greig, report on the Littleton intrusion, 12 March 2025. Evidence of what was said. therecord.media
PressCBS News, 60 Minutes, "China is hacking America's critical infrastructure, former NSA and retired Gen. Tim Haugh warns," broadcast and transcript, 12 October 2025. Evidence of what was said. cbsnews.com
PressCBS News, web article accompanying the 60 Minutes segment, 12 October 2025. Evidence of what was said. cbsnews.com
Cite this page
BlastWave. “Volt Typhoon Intrusion at Littleton Electric Light and Water (2023): What Is Verified.” Hackopedia, Volume 2, FILE 049. Last verified 28 September 2026. https://hackopedia.blastwave.com/energy/volt-typhoon-littleton-2023/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 049 in Hackopedia Volume 2, in the Energy edition.
28 Sep 2026
Hand-check at source: the October 2025 60 Minutes transcript and CBS's companion article read, confirming the $50,000 narration, the chemical tanks passage, the five-year figure and the no-malware statement, all of which stay labelled as broadcast material. Checked against related entries so the Voltzite alias is stated the same way throughout.
26 Sep 2026
Full validation: every quotation re-read at the utility's statement, the Dragos case study and blog, the federal advisory and the interviews. Findings from Dragos's blog on an unnamed customer are now kept separate from the Littleton record; the utility's account of discovery now includes its work with CISA to install sensors; the 300-day problem is stated as Dragos's own dates falling short, not as a conflict with the utility's account; and the officials who arrived the following Monday are described as federal officials.
24 Sep 2026
Volume 2 entry built from primary sources: the utility's statement, the federal advisory, Dragos's case study and blog, and dated interviews with the utility's officials.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
