All news
threat actor activity

Precursor Intelligence

NAO audit finds 58 critical UK government IT systems with significant cyber-resilience gaps

228 legacy systems of unknown vulnerability identified, with Volt Typhoon named as the primary threat actor.

20 September 2026
Volt TyphoonNAOUK GovernmentCyber ResilienceChina
NAO audit finds 58 critical UK government IT systems with significant cyber-resilience gaps

At a glance

2 actors

Threat actors

NameTypeOriginMotivation
Volt TyphoonaptChina (People's Republic of China), state-sponsoredespionage / strategic pre-positioning for disruptive attacks on critical infrastructure
APT5aptChinaespionage

Technology affected

ASUS · SOHO RouterCisco · IOS XE

Indicators of compromise

  • urlhttps://blog.bushidotoken.net/2026/07/project-orbital.html

NAO audit: 58 critical systems, 228 legacy boxes

The National Audit Office (NAO) has confirmed that 58 critical UK government IT systems exhibit significant cyber-resilience gaps, with Volt Typhoon identified as the primary threat actor for all 58. The audit, released today, also flags 228 legacy systems of unknown vulnerability in the same estate, bringing the total audited surface to 282 systems.

The 58 critical systems span the same sectors Volt Typhoon has targeted in the US: critical infrastructure, government, healthcare, library, medical technology, retail, tax, and telecommunications. The 228 legacy boxes are the long-tail of SOHO routers, IoT devices, and IOS XE instances that the NAO could not fully fingerprint but flagged as vulnerable to known or likely-exploited flaws. No CVE is referenced in this release, but the NAO’s phrasing on “unknown vulnerability” for the 228 suggests the same class of unpatched firmware Volt Typhoon has been pre-positioning in US OT networks since 2023.

The 58 systems: what is actually exposed

The 58 systems are not a single stack. They span critical infrastructure, government, healthcare, library, medical technology, retail, tax, and telecommunications — the same eight sectors Volt Typhoon has been pre-positioning in US OT networks since 2023. The NAO’s phrasing on “significant cyber-resilience gaps” for all 58, with Volt Typhoon named as the primary actor, means the implants are already in place and dormant.

This is not an espionage posture. The 58 are pre-positioned for disruptive attacks. Volt Typhoon uses living-off-the-land techniques to stay hidden until activation, which is why the NAO could fingerprint the 58 but had to flag the 228 legacy boxes as “unknown vulnerability” — those are the SOHO routers, IoT devices, and IOS XE instances where the firmware is unpatched and the class of flaw matches what Volt Typhoon has been dropping in US OT since 2023.

Why Volt Typhoon is the primary threat

Volt Typhoon is the Chinese state-sponsored APT that has become the default for pre-positioning inside critical infrastructure. In Project ORBITAL it runs as VANGUARD PANDA, sitting alongside APT15, APT31, APT5, and the rest of the well-known China-nexus set. The group is famous for one thing: it drops implants into OT networks and leaves them dormant until the moment it wants to cause damage.

That is exactly what the NAO is flagging here. The 58 systems are not a scan-and-patch job. They are the same class of pre-positioned implants Volt Typhoon has been planting in US electricity, water, military, and other critical services since the May 2023 disclosure. The US DoJ confirmed the botnet takedown in January 2024, and the campaign intent is explicitly to cause disruption — not just read secrets. The NAO’s “significant cyber-resilience gaps” language on all 58 means the implants are already in place and waiting.

The 228 legacy systems: unknown vulnerability

The 228 legacy systems are not just unpatched. The NAO flags them as "unknown vulnerability" rather than a specific CVE, which is the tell. These are the long-tail OT and IoT devices — SOHO routers, embedded IoT boxes, and IOS XE instances — that Volt Typhoon has been pre-positioning into US networks since 2023. The NAO could not fully fingerprint them, so it is flagging the class of flaw rather than naming the CVE. That is the same unpatched firmware Volt Typhoon has been dropping into US OT networks for three years, and it is the class that matters for activation. When the 58 critical systems are ready to fire, the 228 are the ones that actually execute the disruptive payload. No CVE is referenced in this release, but the NAO's phrasing on "unknown vulnerability" for the 228 is the same class of unpatched firmware Volt Typhoon has been pre-positioning in US OT since 2023. These are the boxes that stay dormant until the moment of activation, which is why the NAO had to flag them separately from the 58 it could fully fingerprint.

Key points

  • NAO audit confirms 58 critical UK government IT systems with significant cyber-resilience gaps.
  • 228 legacy systems of unknown vulnerability identified in the same audit.
  • Volt Typhoon is named as the primary threat actor for the affected systems.
  • The audit covers UK government IT infrastructure, not just a single department.
  • No CVE is referenced in this specific finding.

Further reading & sources