Silent Train: uncovering Volt Typhoon's operational framework for zero-day exploitation and strategic access - Lumen Technologies
Chinese hacking group Volt Typhoon has developed a covert network called Silent Train to gain access to critical infrastructure and enterprise systems through zero-day exploits.
Black Lotus Labs has tracked Volt Typhoon's covert access network, dubbed 'Silent Train,' for the past three years, leading to hundreds of victim notifications in strategically significant sectors. This activity has uncovered zero-day exploits used for initial access to critical systems.
Strategic Targeting
First identified in late 2023, Silent Train uses rotating chains of compromised small office/home office (SOHO), IoT and enterprise infrastructure. It employs anti-forensic techniques, compartmentalized operations and post-operation cleanup to minimize detection and attribution.
Black Lotus Labs uncovered at least four confirmed and one likely zero-day vulnerabilities that Volt Typhoon exploited, targeting network and endpoint management systems, SD-WAN orchestrators and control plane infrastructure.
Critical Infrastructure Focus
Victims included telecommunications providers, government agencies, defense contractors, satellite and mission-critical communication services, universities, IT firms and critical infrastructure such as water, energy, transportation, maritime, rail, aviation and emergency services.
Victimology indicates deliberate efforts to maintain access to critical ecosystems that support defense, logistics, communications, military and civilian operations, especially during heightened tensions or crises in the Indo-Pacific region.
Operational Evolution
The disruption of KV-botnet in late 2023 forced Volt Typhoon to develop a more elusive obfuscation framework. Black Lotus Labs first observed consistent Silent Train activity in November 2023, shortly before the initial KV-botnet takedown.
Instead of relying on persistent infrastructure, Volt Typhoon adopted disposable chains of compromised devices that could be rebuilt as needed. This approach allowed the group to carry out exploitation and post-exploitation activity securely while reducing detection risk.
Technical Implementation
Silent Train operates as a layered, multi-hop framework that routes activity through multiple devices before reaching targets. Sessions began from virtual private servers (VPS) outside the US, then daisy-chained through compromised non-US devices before pivoting within the US to reach targets.
Black Lotus Labs observed more than 27 device classes exploited in Silent Train operations, ranging from SOHO and IoT devices to enterprise platforms. Some relay device types lack known vulnerabilities, suggesting the group leveraged undisclosed zero-day exploits to set up relays.
Related
