Lumen Black Lotus Labs details Volt Typhoon's 'Silent Train' relay framework behind zero-day attacks on US critical infrastructure
Lumen's Black Lotus Labs published research on Silent Train, a covert operational framework used by China-linked Volt Typhoon and tracked since November 2023. It chains rotating compromised SOHO, IoT and enterprise devices with disposable VPS nodes to hide activity and complicate attribution. Monitoring led to hundreds of victim notifications and uncovered four confirmed and one likely zero-day campaigns against endpoint/network management systems, SD-WAN orchestrators and other control plane technologies. Victims span telecommunications, government, defense contractors, satellite communications, MSPs and critical infrastructure (water, energy, transportation, maritime, rail, aviation, emergency services), with Hawaii, California and Texas most targeted.
Detalhes técnicos
- Sessions start on disposable non-US VPS, pass through a second VPS, then compromised non-US SOHO/IoT devices, and end at a compromised US-based device acting as a domestic exit point. Up to six hops were seen.
- More than 27 device classes were used, including TP-Link, Netgear Orbi, Fortinet, Intelbras, Ruckus, SATO, Zyxel and Cambium. Device types kept fixed roles (e.g., Intelbras only as overseas relays, Netgear Orbi as US hops).
- Operators exploited exposed web interfaces, deployed temporary SSH services, keys, config files and living-off-the-land utilities, then removed artifacts. Sessions averaged about four hours.
- Since early 2025, enterprise platforms (Fortinet, Cisco, PRTG, Mirth Connect, CyberPanel) remained active for one to three months as end-of-chain nodes. Reverse tunnels via open-source proxies Chisel and FRP were added.
- Silent Train was reserved for exploitation, credential access, exfiltration and ongoing engagement; reconnaissance used separate ORB networks. Sessions involved one to five victims, mostly one organization.
- Activity followed Monday-Friday, 09:00-22:00 China Standard Time, with a drop during Chinese New Year, suggesting human operators.
- Targeted technologies included Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto, ServiceNow and ArcGIS. Telemetry could not always tell whether known or undisclosed flaws were used. No CVEs were named.
Remediação
- Inventory and minimize internet-facing administrative services; restrict access via VPNs, jump hosts or dedicated management networks.
- Prioritize patching of management and control plane platforms.
- Review downstream permissions and trust relationships of management platforms.
- Centralize logging, extend retention and export telemetry.
- Hunt for unusual admin logins, abnormal API usage, remote file transfers, configuration changes and off-hours living-off-the-land activity.
- Apply CISA and NCSC guidance on Volt Typhoon and China-nexus covert networks.
Linha do tempo
-
Lumen Black Lotus Labs details Volt Typhoon's 'Silent Train' relay framework behind zero-day attacks on US critical infrastructure
ler a análise desta fonte ocultar
Lumen's Black Lotus Labs published research on Silent Train, a covert operational framework used by China-linked Volt Typhoon and tracked since November 2023. It chains rotating compromised SOHO, IoT and enterprise devices with disposable VPS nodes to hide activity and complicate attribution. Monitoring led to hundreds of victim notifications and uncovered four confirmed and one likely zero-day campaigns against endpoint/network management systems, SD-WAN orchestrators and other control plane technologies. Victims span telecommunications, government, defense contractors, satellite communications, MSPs and critical infrastructure (water, energy, transportation, maritime, rail, aviation, emergency services), with Hawaii, California and Texas most targeted.
Technical Details
- Sessions start on disposable non-US VPS, pass through a second VPS, then compromised non-US SOHO/IoT devices, and end at a compromised US-based device acting as a domestic exit point. Up to six hops were seen.
- More than 27 device classes were used, including TP-Link, Netgear Orbi, Fortinet, Intelbras, Ruckus, SATO, Zyxel and Cambium. Device types kept fixed roles (e.g., Intelbras only as overseas relays, Netgear Orbi as US hops).
- Operators exploited exposed web interfaces, deployed temporary SSH services, keys, config files and living-off-the-land utilities, then removed artifacts. Sessions averaged about four hours.
- Since early 2025, enterprise platforms (Fortinet, Cisco, PRTG, Mirth Connect, CyberPanel) remained active for one to three months as end-of-chain nodes. Reverse tunnels via open-source proxies Chisel and FRP were added.
- Silent Train was reserved for exploitation, credential access, exfiltration and ongoing engagement; reconnaissance used separate ORB networks. Sessions involved one to five victims, mostly one organization.
- Activity followed Monday-Friday, 09:00-22:00 China Standard Time, with a drop during Chinese New Year, suggesting human operators.
- Targeted technologies included Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto, ServiceNow and ArcGIS. Telemetry could not always tell whether known or undisclosed flaws were used. No CVEs were named.
Remediation
- Inventory and minimize internet-facing administrative services; restrict access via VPNs, jump hosts or dedicated management networks.
- Prioritize patching of management and control plane platforms.
- Review downstream permissions and trust relationships of management platforms.
- Centralize logging, extend retention and export telemetry.
- Hunt for unusual admin logins, abnormal API usage, remote file transfers, configuration changes and off-hours living-off-the-land activity.
- Apply CISA and NCSC guidance on Volt Typhoon and China-nexus covert networks.