Volt Typhoon hides zero-day attacks using 'Silent Train' framework
Black Lotus Labs said the group rebuilt relay chains in under two minutes and used them to hide attacks on critical infrastructure.
- On Wednesday, Black Lotus Labs reported that Chinese state-sponsored group Volt Typhoon has utilized a disposable hacking framework dubbed 'Silent Train' to infiltrate sensitive United States critical infrastructure networks undetected.
- Volt Typhoon shifted toward Silent Train after the FBI and Justice Department disrupted the group's KV Botnet infrastructure in early 2024, researchers said. The new framework relies on rotating chains of compromised devices to hide attack origins.
- Operators rebuild these chains in under two minutes, removing all tooling and keys from disposable relays in under 8 hours, and researchers confirmed Volt Typhoon exploited at least four zero-day vulnerabilities in edge and management infrastructure.
- Michael Horka, principal information security engineer at Black Lotus Labs, said the framework is "fundamentally difficult to disrupt because there isn't one network to take down." The group frequently targets critical infrastructure in California, Texas, and Hawaii.
- Researchers recommend that organizations restrict internet access to administrative interfaces and rapidly patch vulnerabilities to counter these persistent threats. Silent Train's continuous refresh ensures Volt Typhoon maintains access to high-value targets across the United States.
13 Articles
13 Articles
Volt Typhoon linked to covert Silent Train network in four zero-day campaigns
Chinese state-linked threat actor Volt Typhoon reportedly used a covert infrastructure cluster dubbed Silent Train across four separate zero-day exploitation campaigns. The activity is tied to cyber espionage operations and indicates...
CyberScoop
IT Security News - cybersecurity, infosecurity newsResearchers uncover Volt Typhoon’s covert, ephemeral network
The China-linked threat group has used the “Silent Train” framework, built on a series of rapidly rotating compromised devices, to infiltrate hundreds of critical infrastructure networks.
China’s ‘Volt Typhoon’ quietly built another hacking network following US crackdown, new findings say
New research traces a three-year operation targeting government, defense and critical infrastructure networks. Sources say Energy Department facilities and utilities have also been affected.
Volt Typhoon hides zero-day attacks using 'Silent Train' framework
Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems. [...]
Coverage Details
Bias Distribution
- 80% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
