Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns
Volt Typhoon operated covert Silent Train network for zero-day exploitation targeting critical infrastructure.
China-nexus threat actor Volt Typhoon has been attributed to a disrupted covert access network called Silent Train, which was identified in late 2023 and used rotating chains of compromised SOHO, IoT, and enterprise infrastructure. The network was leveraged across four zero-day exploitation campaigns for strategic access. Black Lotus Labs disclosed the operation in a report detailing the actor's sophisticated access methodology.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Lumen Technologies?
Get an email when a new story names Lumen Technologies, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonVolt Typhoon, a China-nexus threat actor, exploited four separate zero-day vulnerabilities to build and operate a covert relay network composed of compromised SOHO routers, IoT devices, and enterprise infrastructure. By chaining these devices into a rotating anonymization network, the group was able to mask attribution and maintain persistent strategic access to targets. This operation highlights that internet-exposed edge devices — often running unpatched or unsupported firmware — represent a critical and frequently overlooked attack surface. Organizations that fail to inventory, monitor, and patch such devices effectively hand sophisticated adversaries a ready-made covert infrastructure.
What helps against this
How we list vendors- External attack surface management (EASM)
You find your forgotten internet-facing systems before attackers do.
- Cyber asset inventory
You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.