Covered by 5 outlets — first reported by BleepingComputer, Oct 28, 16:00 UTC
Volt Typhoon hides zero-day attacks using 'Silent Train' framework
Summary
Lumen Technologies' Black Lotus Labs has tied a covert network it calls Silent Train to the China-linked group Volt Typhoon. BleepingComputer says it relies on rotating chains of compromised devices, including small-office, IoT and enterprise equipment, to hide attacks on high-value systems. The Hacker News and Security Affairs report it was used in four zero-day campaigns (flaws exploited before a fix existed), and SecurityWeek says Cisco Talos linked malware that stole keys on Cisco SD-WAN systems to overlapping infrastructure. The Hacker News describes the network as now disrupted.
AI summary by the SecurityTabs newsroom, checked against BleepingComputer, The Hacker News, SecurityWeek, Security Affairs. Read the outlets below for the full story.
Continue reading
5 outlets, in the order they reported it.
BleepingComputerFirst report
Volt Typhoon hides zero-day attacks using 'Silent Train' framework
Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems.
The Hacker News
Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns
The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been put to use for zero-day exploitation and strategic access.
SecurityWeek
Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network
Cisco Talos linked SD-WAN key-stealing malware to infrastructure overlapping Volt Typhoon’s Silent Train network, which Lumen detailed.
Security Affairs
Volt Typhoon Used Silent Train to Hide Zero-Day Attacks
Volt Typhoon used disposable relay chains to hide zero-day attacks on critical systems. Lumen linked Silent Train to at least four zero-days.
Help Net Security
Volt Typhoon targeted enterprise control planes via ever-changing “Silent Train” relay network
Volt Typhoon, a Chinese state-sponsored APT group that’s focused on cyberespionage and United States’ critical infrastructure, has been using a covert, constantly rotating relay network to hide its most sensitive intrusions, Lumen’s Black…
Explained
The technology and terms in this story. Learn more
- ConceptZero-dayA flaw attackers exploit before the vendor has a fix: defenders have had zero days to patch.
- ConceptAPT · Advanced persistent threatA well-resourced hacking group, usually tied to a government, that runs long, targeted campaigns.
- ConceptExploitCode or a technique that turns a software flaw into something an attacker can actually use.