Lumen says Volt Typhoon banks Silent Train access in infrastructure
Original title: A deep dive into China’s Volt Typhoon suggests it is preparing for an assault on infrastructure
Lumen says the group rotates exploited SOHO, IoT and enterprise devices, including multiple zero-days, against high-value targets.
Lumen’s Black Lotus Labs described Silent Train, a Volt Typhoon tactic that rapidly rotates chains of compromised SOHO, IoT and enterprise devices, exploits them on demand, and then cleans them up. Lumen said multiple intrusions were confirmed and that at least four confirmed and one likely zero-day targeted network and endpoint management systems, SD-WAN orchestrators and control-plane infrastructure. Named victim sectors included telecommunications, government, defense, satellite communications, universities, IT and critical infrastructure. Quoted analysts framed the activity as access prepared for a later geopolitical crisis rather than immediate theft.
Unconfirmed: China attribution and the claim that access is banked for a Pacific crisis are analysts’ judgments.
- Lumen said operators could assemble device chains in under two minutes.
- Intelbras modems served as overseas relays and Netgear Orbi devices as US hops.
- Those device roles stayed fixed across three years of monitoring.
- Lumen tied the targeting to defense, logistics and communications in the Indo-Pacific.
Impact: Pre-positioned access to management and infrastructure systems
- 1.Take management consoles, SD-WAN orchestrators and admin portals off the open internet.
- 2.Place those systems behind a VPN, jump host or dedicated management network.
- 3.Patch control-plane technology before other systems.
- Products
- Intelbras modemsNetgear Orbi
- Threat actors
- Volt Typhoon
- Organizations
- LumenBlack Lotus Labs
- Countries
- ChinaUnited States
From the original article
6 min read at csoonline.com
In a deep dive into the Silent Train attack tactic used by China’s Volt Typhoon cybercrime group, Lumen’s Black Lotus Labs highlighted evidence of efforts to pre-position access within what it described as “strategic communications, critical infrastructure and other ecosystems that become essential during geopolitical tensions or crises.”
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.