Sandfly Blog

Key Takeaways

• The Threat: Nation-state groups like Volt Typhoon and Salt Typhoon are targeting critical Operational Technology (OT) infrastructure using "Living off the Land" techniques to evade detection.
• The Warning: Recent advisories from the Cybersecurity and Infrastructure Security Agency (CISA), including the 2025 Threat Assessment and advisory AA25-239, confirm these groups are actively pre-positioning for disruptive attacks.
• The Problem: Traditional Endpoint Detection and Response (EDR) agents cause system instability, trigger kernel panics, and drain critical resources in fragile OT networks.
• The Solution: Sandfly Security utilizes agentless security. This method operates via standard SSH to detect intruders without altering the system state, avoiding kernel hooks, and maintaining zero permanent footprint.

The Shift in Critical Infrastructure Threats

At Sandfly, we work with many customers in the critical infrastructure space and frequently deal with unusual Operational Technology (OT) applications and hardware. OT infrastructure security is an interesting area because it almost always involves Linux, and it often involves systems that cannot go down for any reason. This is exactly the type of environment where agentless security like Sandfly excels.

In particular, OT security presents several significant challenges where traditional agent-based Linux EDR solutions have a tough time operating:

• They often run on custom Linux versions and hardware.
• They may be running older versions of Linux and are not updated regularly.
• They run on a mix of CPUs, ranging from standard x86 (Intel/AMD) to ARM, MIPS, PowerPC, and more.
• They are often left unmonitored, making them juicy targets for nation-state attackers.

Two of the most formidable threats currently active are Chinese state-sponsored groups dubbed Volt Typhoon and Salt Typhoon. They specialize in targeting and compromising OT infrastructure.

According to recent joint advisories from CISA, the NSA, and the FBI (advisory AA25-239), these advanced persistent threat actors exhibit tactics that extend beyond traditional espionage. While Salt Typhoon focuses heavily on massive-scale data theft by exploiting telecommunications infrastructure, Volt Typhoon actively pre-positions itself within power grids, water treatment facilities, and communication networks. The CISA threat assessment indicates that this positioning is designed to enable disruptive or destructive cyberattacks during potential future geopolitical conflicts.

Both groups evade detection by targeting edge networks and exploiting the soft underbelly of OT environments: Linux-based embedded devices, legacy servers, and routing equipment. For security teams, protecting these environments creates a paradox. You need deep visibility to catch stealthy intruders, but traditional endpoint security tools are often too dangerous to install on fragile, mission-critical OT systems.

"Linux" is an Umbrella Term

At Sandfly, we have a tremendous amount of experience working in mission-critical and OT environments that run Linux. Here are three examples where we are trusted in extremely critical OT environments:

• Vay: A teledriving vehicle company where Sandfly is used to monitor remotely driven vehicles operating on public roads where safety is paramount.
• Ericsson: Trusted to protect their telecommunications customers and equipment globally.
• Car Manufacturer: Used on systems serving assembly lines for a major automobile manufacturer.

So when we talk about protecting OT systems, we are not just spewing marketing. Rather, we have practical, real-world experience watching some of the most important networking gear on the planet.

The primary challenge with protecting OT systems is that they rely heavily on Linux, and "Linux" is simply an umbrella term. Because the operating system is incredibly adaptable, a Linux deployment can be anything from a massive GPU cluster training an artificial intelligence model to a highly constrained embedded device in an IP camera or robot.

This extreme variety is where agent-based Endpoint Detection and Response (EDR) solutions reveal massive coverage gaps. While a traditional EDR vendor might claim they "support Linux," OT security teams must immediately ask the following critical questions:

• Which distributions? The ecosystem is deeply fragmented across dozens of commercial and open-source distributions.
• Which kernel versions? Thousands of unique Linux kernels exist, and OT vendors frequently compile custom kernels to suit highly specialized hardware.
• Which CPU architectures? While standard x86 processors dominate corporate servers, the smaller networking devices making up the OT edge rely heavily on ARM or MIPS architectures.
• What are the resource costs? This is the ultimate dealbreaker. Technologies like eBPF have solved some of the past kernel monitoring problems, but performance impacts still exist. We have repeatedly heard from customers that agents routinely consume 10% to 30% or more of system resources, which can immediately cripple or crash a fragile OT system.

Sandfly can handle all of these scenarios, from cloud-based deployments down to a tiny Linux controller buried in a broom closet. Because agent-based systems cannot deploy across this wide range of hardware, many security teams are left with massive visibility gaps where attackers like Salt Typhoon and Volt Typhoon can infiltrate and remain undetected for extended periods. Sandfly aims to stop that because we are designed to watch everything reliably and leave no blind spots.

What is "Living off the Land" and Why Do the Typhoons Use It?

Volt Typhoon and Salt Typhoon do not operate like typical hackers. When infiltrating a facility, they rarely drop noisy, recognizable malware files that trigger alarms. Instead, they utilize Living off the Land (LOTL). LOTL is a cyberattack technique where adversaries use legitimate, pre-installed administrative tools (like SSH, netcat, bash scripts, and more) to execute attacks, allowing them to evade traditional signature based malware detection. This is because these tools are not malware, but just being used maliciously.

Once these attackers compromise public facing edge devices with outdated firmware or weak credentials, they proxy their traffic to look like normal network activity. By hijacking legitimate system utilities, they blend in seamlessly with the daily activities of system administrators. Further, because they avoid introducing third party malware, traditional detection solutions may remain completely blind to their presence.

Finding these stealthy intruders requires analyzing system state and behavior, which typically demands EDR capabilities. However, bringing traditional EDR agents into an operational technology space introduces a severe set of risks that an agentless approach like Sandfly completely avoids.

Why Does Traditional EDR Fail in OT Environments?

Operational Technology runs the physical world. A crashed workstation in a corporate IT environment means a single annoyed employee. A crashed server in an OT environment can mean a regional power blackout or telephones stop working.

Traditional agent based EDR platforms are fundamentally ill-suited for high availability Linux environments for three major reasons:

1. The Risk of Kernel Panics: Traditional EDR agents require hooks into the Linux kernel to intercept system calls and monitor activity. If an agent encounters a software bug or a conflict, it can trigger a kernel panic, immediately crashing the server. In OT environments where total uptime is non-negotiable, this risk is unacceptable. Even eBPF solutions have caused kernel panics due to bugs. Interfacing with the kernel always carries this risk.
2. Compatibility and Russian Roulette Patching: The Linux ecosystem is incredibly fragmented across varying distributions and CPU architectures like ARM and MIPS. Agent based tools are highly dependent on specific kernel versions. If an EDR vendor does not support the exact kernel version running on your custom hardware for instance, you are left unprotected. Furthermore, applying a critical operating system patch can break the EDR agent or the EDR agent upgrade can break the kernel. This can leave the system unprotected, or worse, bricked.
3. Voids Service Contracts: Many vendors have service contracts that prohibit loading or modifying the hardware. Installing an agent that causes an outage or damages the equipment may void service agreements resulting in a costly mistake.
4. Resource Drain: Persistent EDR agents are always on and continuously consume processor and memory resources. In resource constrained embedded systems and legacy servers, an EDR agent demanding up to 30% of system resources can degrade performance to the point of operational failure.

Because of these massive hurdles, many OT administrators choose to run their Linux fleets completely unmonitored. This leaves the door wide open for groups like Salt and Volt Typhoon to enter and linger in the most critical of critical infrastructure.

How Does Agentless Security Protect OT Environments?

Sandfly Security solves the visibility paradox by completely rethinking how Linux security works. Instead of forcing a persistent software agent onto the endpoint, Sandfly utilizes Agentless Security. Agentless Security is a cybersecurity approach that monitors and protects systems without requiring the installation of any persistent software or background services on the target device. Basically, if endpoint agents cause all of these compatibility and performance headaches on Linux, what if we just got rid of it?

Here are some of the benefits of not using an endpoint agent in OT environments:

Zero Kernel Interaction

Sandfly connects to endpoints using standard SSH and runs its investigative modules entirely in user space. It never loads kernel modules, it does not hook system calls, and it does not rely on eBPF technologies. Not tying into kernel space drastically lowers crash risks on production systems. If a Sandfly scan fails for any reason, it simply logs an error and stops, leaving zero impact on the host system.

Universal Compatibility

Because it relies on standard SSH and pre-compiled static binaries, Sandfly works on virtually any Linux system. It effortlessly monitors modern cloud instances alongside decade old legacy servers, Internet of Things devices, and embedded hardware. It fully supports many CPU architectures like ARM, MIPS, and PowerPC, which are heavily prevalent in OT networking gear.

Invisible Performance Footprint

When Sandfly is not actively scanning a host, its resource consumption is exactly zero. When an automated scan triggers, it runs as a brief, low priority burst that typically consumes less than 2% of aggregate CPU for roughly 60 to 120 seconds at low priority before disappearing completely. This lightweight approach ensures that mission critical processes are never starved of compute resources. We've had this claim tested multiple times by mission critical users and are happy to show you how we can do this.

How Can You Hunt the Typhoons Without Agents?

How do you use an agentless tool to catch an elite adversary that hides in plain sight? Sandfly is specifically designed to hunt the exact Living off the Land tactics that actors like Salt and Volt Typhoon rely upon.

• Credential and SSH Key Auditing: Threat actors steal passwords and SSH keys to quietly persist on networks. Sandfly proactively monitors endpoints for weak passwords and audits SSH keys with our SSH Hunter to detect unauthorized credential usage. It can even perform agentless response actions, like deleting rogue SSH keys, cutting off the attacker's primary method of lateral movement.
• Drift Detection: Even the most sophisticated attackers must alter something to maintain access. Sandfly continuously monitors systems for unauthorized modifications. It detects tampering across processes (including fileless malware), users, critical system binaries, persistence mechanisms, and more. It is extremely difficult to modify a host without being seen with this feature active and can completely lock down OT devices against tampering.
• Tactics and Behavioral Analysis: Instead of looking for known malware files, Sandfly looks for the results of malicious behavior. It roots out hidden processes, suspicious network connections, and unauthorized activity that indicate a system is compromised. This style of tactics hunting does not go stale like traditional malware signatures often do.
• Incident Response: Because there is no need to deploy an agent, Sandfly can be instantly used in incident response investigations to see if sophisticated attackers like Salt Typhoon or Volt Typhoon are present in the infrastructure. The deployment is fast and safe so security teams can get answers without impacting critical operations.

Securing the Future of Critical Infrastructure

The convergence of IT and OT networks has given nation-state actors an unprecedented avenue into the systems that sustain our daily lives. Defending against pre-positioning campaigns like Volt Typhoon or the massive intelligence sweeps of Salt Typhoon requires total visibility into your Linux and embedded infrastructure.

By abandoning the risky, resource heavy model of traditional endpoint agents, Sandfly Security provides a frictionless, universally compatible solution tailored for the strictest operational environments. It proves that you no longer have to choose between keeping your critical infrastructure stable and keeping it secure.

Stop Choosing Between Uptime and Security

Do not wait for a nation-state actor to test the resilience of your critical infrastructure. See how Sandfly's agentless technology can give you complete, continuous visibility into your Linux and embedded systems without risking downtime. Request a demo today to see how you can start hunting threats like Volt Typhoon before they strike.