Skip to content
securitytabs

LiveUpdated

Volt Typhoon used 'Silent Train' network of hijacked devices in zero-day attacks

Researchers say a Chinese state-linked hacking group hid its attacks behind a constantly changing chain of compromised routers and other devices. The network has been disrupted, and no specific steps for organizations have been published in the coverage reviewed.

Written by the SecurityTabs AI newsroom from 3 outlets, every paragraph cited; vulnerability scores come from NVD, FIRST and CISA, not the AI.

What's new

Newest coverage

TimelineWhat should my organization do?

What happened

BleepingComputer reports that the Chinese state-sponsored group Volt Typhoon used a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks (attacks using flaws unknown to the vendor) on high-value systems. [1]

The Hacker News, citing a report from Lumen Technologies Black Lotus Labs, says the group has been attributed to a covert access network called Silent Train, which it describes as now disrupted. Lumen says Silent Train was first identified in late 2023 and uses rotating chains of compromised small-office and home-office, internet-of-things and enterprise equipment. [2]

Scale and use

The Hacker News says the network was used in four zero-day exploitation campaigns and for strategic access. CyberScoop reports the group used Silent Train to infiltrate hundreds of critical infrastructure networks. [2][3]

What is not yet known

The excerpts reviewed do not name the products targeted by the zero-day attacks, list indicators of compromise, or describe patches or mitigations. Readers should consult the Lumen report and vendor advisories for those details. [1][3][2]

Timeline

  1. CyberScoop reported the group used the framework to infiltrate hundreds of critical infrastructure networks. [3]

  2. The Hacker News reported the Silent Train network had been disrupted. [2]

  3. BleepingComputer, CyberScoop and The Hacker News reported on Lumen's findings about the Silent Train network used by Volt Typhoon. [1][3][2]

Explained

The technology and terms in this story. Learn more

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Reporting says the compromised devices included small-office and home-office and internet-of-things equipment. No fix or indicators were described in the coverage reviewed. [2]

What to do

  1. Ask your IT provider whether your routers and connected devices are still supported and receiving vendor updates. [2]
  2. Watch for vendor and government advisories on the Volt Typhoon activity. [1]

Mid-size company

A small IT or security team

What to know

Lumen says Silent Train used rotating chains of compromised edge and enterprise infrastructure, which can make attacker traffic appear to come from ordinary devices. No indicators were included in the excerpts reviewed. [2]

What to do

  1. Inventory internet-facing routers, IoT and enterprise devices and confirm each has vendor support. [2]
  2. Review Lumen Black Lotus Labs' report for any published indicators once available. [2]

Large enterprise

A security operations team

What to know

CyberScoop reports the group infiltrated hundreds of critical infrastructure networks, and The Hacker News reports four zero-day campaigns used the network. [3][2]

What to do

  1. Obtain the Lumen Black Lotus Labs report and compare any indicators against edge-device and network logs. [2]
  2. Hunt for unexpected access from small-office, IoT or enterprise devices that connect to your environment. [1][2]
  3. Review third-party and critical-infrastructure connections for exposure to this activity. [3]

Sources

  1. [1]BleepingComputer · Oct 28, 16:00 UTC
    Volt Typhoon hides zero-day attacks using 'Silent Train' frameworkcontext
  2. [2]The Hacker News · Oct 28, 18:08 UTC
    Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaignscontext
  3. [3]CyberScoop · Oct 28, 16:00 UTC
    Researchers uncover Volt Typhoon’s covert, ephemeral networkcontext