Volt Typhoon rebuilt Silent Train relay chains since late 2023
Original title: Researchers uncover Volt Typhoon’s covert, ephemeral network
Black Lotus Labs says chains were rebuilt in under two minutes and hundreds of victims were notified.
Lumen’s Black Lotus Labs says China-linked Volt Typhoon has used Silent Train, rotating compromised SOHO routers, IoT devices, and enterprise systems, since late 2023 to reach hundreds of sensitive networks. Researchers describe daily assembly and teardown, sessions averaging roughly four hours, and confirmed zero-day campaigns against Versa Director, N-able N-central, Cisco Catalyst SD-WAN, and VeloCloud Orchestrator. Use increased after the FBI and Justice Department disrupted KV Botnet in early 2024. Notified sectors include telecom, government, defense, universities, IT, water, energy, transportation, maritime, rail, aviation, and emergency services.
Unconfirmed: Researchers say the ephemeral design means their victim observations are incomplete.
- More than 27 device classes were exploited or abused, researchers said.
- Named vendors include Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto Networks, ServiceNow, TP-Link, Netgear, and ArcGIS.
- Horka said observations are not a complete census of Volt Typhoon activity.
- Infrastructure was rebuilt with different nodes in less than two minutes.
Impact: Persistent access to US communications, defense, government, and critical infrastructure
| Product | Affected |
|---|---|
| Versa Director | — |
| N-able N-central | — |
| Cisco Catalyst SD-WAN | — |
| VeloCloud Orchestrator | — |
- Threat actors
- Volt Typhoon
- Malware
- Silent TrainKV Botnet
- Countries
- ChinaUnited States
From the original article
4 min read at cyberscoop.com
The China-linked threat group has used the “Silent Train” framework, built on a series of rapidly rotating compromised devices, to infiltrate hundreds of critical infrastructure networks. The post Researchers uncover Volt Typhoon’s covert, ephemeral network appeared first on CyberScoop.
By Matt Kapko · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.