[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fcTSkTOnN4XmeoFMkLbBBWGMwfdKFtV3YZqjwCSG7_Zo":3},{"article":4,"iocs":52,"watch_terms":53,"solutions":54,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"aa64c2ea-5a2b-4e51-b264-623149f9cc77","Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns","volt-typhoon-used-covert-silent-train-network-in-four-zero-day-exploitation-camp-3402ef","The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been put to use for zero-day exploitation and strategic access. \"First identified in late 2023, Silent Train uses rotating chains of compromised SOHO, IoT, and enterprise infrastructure,\" Lumen Technologies Black Lotus Labs said in a report shared","China-nexus threat actor Volt Typhoon has been attributed to a disrupted covert access network called Silent Train, which was identified in late 2023 and used rotating chains of compromised SOHO, IoT, and enterprise infrastructure. The network was leveraged across four zero-day exploitation campaigns for strategic access. Black Lotus Labs disclosed the operation in a report detailing the actor's sophisticated access methodology.","Volt Typhoon operated covert Silent Train network for zero-day exploitation targeting critical infrastructure.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fvolt-typhoon-used-covert-silent-train.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhXuRyHXVM1n6S9Z49nYkM2dmJjKwuZx2RAre0CQSpB202GteLj8keMogqzR7ZVIv7YRc9udBHU7-oCpnpzL6nLaez3ypbVr9cVmiH9zFwJVApy5cev84W725y38auaUdkCQGN3zvngCivMUl-SYV1jnJu9eHduaYeBzro4cdmFHIQJfBQN4RvcC-fUTrs1\u002Fs1600\u002Fsi.jpg","2026-10-28T18:08:33+00:00","2026-10-28T19:00:18.043701+00:00",9,[17,20,23,26,29],{"name":18,"type":19},"Volt Typhoon","threat_actor",{"name":21,"type":22},"Silent Train","campaign",{"name":24,"type":25},"Lumen Technologies","vendor",{"name":27,"type":28},"SOHO infrastructure","technology",{"name":30,"type":28},"IoT devices","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":31,"icon":33,"name":34,"slug":35},null,"Nation-state","nation-state",[37,42,47],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[24],{"controls":55,"vendors":142},[56,85,113],{"slug":57,"name":58,"problem":59,"products":60},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"outpost24","Outpost24","\u002Fvendor-logos\u002Foutpost24.png","outpost24-easm","Outpost24 EASM","https:\u002F\u002Foutpost24.com\u002Fproducts\u002Fexternal-attack-surface-management\u002F","Discovery and risk assessment of internet-facing assets.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"watchtowr","watchTowr","\u002Fvendor-logos\u002Fwatchtowr.png","watchtowr-platform","watchTowr Platform","https:\u002F\u002Fwatchtowr.com\u002Fplatform\u002F","Continuous discovery of internet-facing assets, with automated testing for exploitable vulnerabilities.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"censys","Censys","\u002Fvendor-logos\u002Fcensys.png","censys-external-exposure-management","Censys External Exposure Management","https:\u002F\u002Fcensys.com\u002Fsolutions\u002Fexternal-exposure-management","External attack surface discovery based on continuous internet-wide scanning.",{"slug":86,"name":87,"problem":88,"products":89},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[90,97,105],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":92,"url":95,"description":96},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"slug":114,"name":115,"problem":116,"products":117},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",[],{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":155},"volt-typhoons-silent-train-zero-day-exploitation-via-covert-sohoiot-network","Volt Typhoon's Silent Train: Zero-Day Exploitation via Covert SOHO\u002FIoT Network","Volt Typhoon, a China-nexus threat actor, exploited four separate zero-day vulnerabilities to build and operate a covert relay network composed of compromised SOHO routers, IoT devices, and enterprise infrastructure. By chaining these devices into a rotating anonymization network, the group was able to mask attribution and maintain persistent strategic access to targets. This operation highlights that internet-exposed edge devices — often running unpatched or unsupported firmware — represent a critical and frequently overlooked attack surface. Organizations that fail to inventory, monitor, and patch such devices effectively hand sophisticated adversaries a ready-made covert infrastructure.",[148,149,150,151,152,153,154],"CIS Control 7: Continuous Vulnerability Management","CIS Control 1: Inventory and Control of Enterprise Assets","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","MITRE ATT&CK T1090: Proxy",{"NIS2 Article 21(2)(b)":156,"MITRE ATT&CK T1090: Proxy":157,"NIST SP 800-53 SI-2: Flaw Remediation":158,"CIS Control 7: Continuous Vulnerability Management":159,"CIS Control 1: Inventory and Control of Enterprise Assets":160,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":161,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":162},"NIS2 mandates risk-based security measures for network and information systems, explicitly covering incident handling and vulnerability management practices that would have detected and limited covert exploitation of edge devices.","Silent Train functioned as a multi-hop proxy network using compromised infrastructure; mapping defensive controls to this technique — such as detecting anomalous relay traffic — is directly relevant to disrupting Volt Typhoon's access methodology.","Zero-day exploitation of edge devices requires a disciplined flaw remediation process, including emergency patching procedures, that would limit the window of exposure on internet-facing infrastructure.","Four zero-day campaigns succeeded in part because edge and IoT devices lacked timely vulnerability identification and remediation; continuous scanning and patching programs would have reduced the exploitable attack surface.","Silent Train relied on unmanaged or poorly monitored SOHO and IoT devices; a complete, maintained asset inventory is the prerequisite for protecting those devices from being co-opted into a covert relay network.","This control requires organizations to systematically identify and remediate technical vulnerabilities in all assets, including IoT and SOHO equipment, which were the foundation of Volt Typhoon's Silent Train infrastructure.","Volt Typhoon used compromised devices to relay traffic and obscure identity; strong device authentication and access control on edge infrastructure would have made it harder to silently incorporate devices into the covert network."]