Volt Typhoon Builds and Dismantles Covert, Ephemeral Networks for Critical Infrastructure Infiltration
China-backed Volt Typhoon group employs 'Silent Train' infrastructure, rapidly rebuilding compromised networks to evade detection and infiltrate hundreds of critical systems.
Volt Typhoon, a China-government backed hacking group with a history of infiltrating American critical infrastructure, has developed and dismantled a sophisticated, ephemeral malicious infrastructure network dubbed "Silent Train." This covert operation, detailed in a report by Lumen Technologies' Black Lotus Labs, allows the group to repeatedly infiltrate hundreds of sensitive systems without sustained detection.
The "Silent Train" network is not a static entity but rather a dynamic series of compromised small office/home office (SOHO) routers, internet of things (IoT) devices, and enterprise infrastructure. Volt Typhoon has demonstrated an alarming capability to rapidly rotate through these compromised nodes, assembling and dismantling individual network chains daily. Researchers observed the group's ability to rebuild a new, functional chain using different infrastructure in under two minutes, making the actual number of compromised nodes at any given moment effectively near zero.
This ephemeral infrastructure serves as a critical tool for Volt Typhoon to exploit additional vulnerabilities, including zero-days, in network edge devices. By establishing these short-lived compromised chains, the group gains deeper, persistent access into victim networks. Black Lotus Labs has notified hundreds of victims across diverse sectors, including telecommunications, government, defense contracting, higher education, IT services, and critical infrastructure domains such as water, energy, transportation, maritime, rail, aviation, and emergency services.
Michael Horka, principal information security engineer at Black Lotus Labs and lead researcher on the report, emphasized the group's remarkable investment in operational security. "Individual chains are assembled and dismantled every day, with infrastructure continually refreshed," Horka stated. "Volt Typhoon demonstrated a repeatable capability to rebuild a new chain with different infrastructure in less than two minutes, making the number of nodes at any one moment effectively close to zero."
The threat group's reliance on Silent Train appears to have increased following the FBI and Justice Department's disruption of the KV Botnet earlier in 2024. This shift aligns with broader warnings from U.S. and global authorities about Chinese hacking groups increasingly utilizing covert networks built on compromised common devices.
Volt Typhoon's Silent Train operations have exploited over 27 different device classes, including edge devices, enterprise management tools, identity and access management systems, and networking infrastructure. The group has successfully compromised devices from major vendors such as Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto Networks, ServiceNow, TP-Link, and Netgear. Notably, confirmed zero-day exploits targeting Versa Director, N-Able N-Central, Cisco Catalyst SD-WAN, and VeloCloud Orchestrator were observed.
"The exploitation patterns, victimology, and geographic targeting observed throughout our investigation point to a sustained focus on communications, defense, government, and critical infrastructure environments of enduring strategic value," the Black Lotus Labs report states. "Through repeated targeting of centralized management platforms and control-plane technologies, Silent Train shows how Volt Typhoon systematically pursues and preserves access to some of the most consequential networks in the United States."
The inherent ephemerality and operational discipline of Silent Train make it exceptionally difficult to disrupt. Unlike traditional botnets or persistent networks, there isn't a single, fixed infrastructure to dismantle. "What exists today will be completely different tomorrow," Horka explained. "You can try to remove individual pieces, but removing the actor’s ability to continuously rebuild them is a much harder problem to solve."