Science & Tech · Cybersecurity · 12 hrs ago
Volt Typhoon used short-lived device chains to hide attacks
Researchers say Volt Typhoon used a system called Silent Train to hide attacks on sensitive networks.
Volt Typhoon is a China-backed hacking group that has targeted U.S. critical infrastructure, and Silent Train links compromised routers, internet-connected devices and enterprise systems to disguise where attacks come from.
The group repeatedly builds and dismantles these device chains, sometimes rebuilding them in less than two minutes, according to researchers at Black Lotus Labs, part of Lumen Technologies.
Researchers confirmed attacks using zero-day flaws in products from Versa, N-able, Cisco and VeloCloud, among other suspected vulnerabilities.
The targets include government, defense, communications and critical infrastructure, as well as universities, IT firms and emergency services.
The attacks can give hackers lasting access and administrative control, raising concerns about networks that support essential services and their customers.
Researchers say there is no single network to shut down because the devices used keep changing; they advise organizations to patch quickly, restrict internet access to administrative systems and monitor unusual activity.
Volt Typhoon used a framework called Silent Train to hide attacks through rapidly rotated chains of compromised devices, researchers said.
Black Lotus Labs said the group used the chains to exploit vulnerabilities, including zero-days, and gain deeper access to victim networks.
The framework has been used since late 2023 and became more prominent after authorities disrupted the KV Botnet in early 2024, according to researchers.
Targets included organizations in communications, government, defense and critical infrastructure.
Researchers said individual chains could be rebuilt with different infrastructure in less than two minutes.
- Who
- Volt Typhoon, a China-government-backed hacking group.
- What
- It used Silent Train, chains of compromised devices, to conceal attacks and access victim networks.
- When
- Researchers tracked the activity since late 2023.
- Where
- Targets included U.S. networks and organizations in sectors such as communications, government, defense and critical infrastructure.
- Why
- The chains concealed the origin of attacks and helped the group preserve access to sensitive networks.
This story does not have two clearly opposing sides.
Volt Typhoon began rotating through chains of compromised infrastructure, according to researchers.
The FBI and Justice Department disrupted the KV Botnet, after which Volt Typhoon relied more heavily on Silent Train, researchers said.
Researchers observed the framework using disposable relays alongside compromised enterprise systems retained for one to three months.
- Framework
- Silent Train
- Tracking period
- Since late 2023
- Chain rebuild time
- Less than two minutes
- Observed session duration
- Roughly four hours on average
- Device classes used
- More than 27
- Most targeted regions
- California, Texas and Hawaii
3 sources
What people are saying
Individual chains are assembled and dismantled every day, with infrastructure continually refreshed.
Volt Typhoon demonstrated a repeatable capability to rebuild a new chain with different infrastructure in less than two minutes, making the number of nodes at any one moment effectively close to zero.
The ephemeral nature of the framework means our observations should not be interpreted as a complete census of Volt Typhoon activity.
Through repeated targeting of centralized management platforms and control-plane technologies, Silent Train shows how Volt Typhoon systematically pursues and preserves access to some of the most consequential networks in the United States.