Black Lotus Labs details Volt Typhoon’s ephemeral Silent Train network

Lumen Technologies’ Black Lotus Labs disclosed that a China-government backed hacking group called Volt Typhoon has for years infiltrated America’s critical infrastructure networks through a covert operation called Silent Train. The unit said in a Wednesday report that the group consistently creates and tears down short-lived malicious infrastructure. The malicious infrastructure enters hundreds of sensitive systems without detection.

Researchers call the covert access operation Silent Train. Silent Train is not a standalone network but a series of compromised SOHO routers, IoT devices and enterprise infrastructure. SOHO routers are small office and home office devices, and IoT devices are internet-connected gadgets. Volt Typhoon has rapidly rotated through Silent Train infrastructure since late 2023.

Black Lotus Labs has notified hundreds of victims since first identifying Silent Train activity.

Victims include universities, IT firms, telecom providers, government entities, defense contractors and communication services. Critical infrastructure victims span organizations in emergency services, aviation, rail, maritime, transportation, energy and water sectors. Black Lotus Labs researchers wrote that patterns of exploitation, victimology and geography show a sustained focus on communications, defense, government and critical infrastructure.

Black Lotus Labs researchers wrote that Silent Train demonstrates how Volt Typhoon systematically seeks and keeps access to important U.S. networks. The group repeatedly targets centralized management platforms and control-plane technologies, the researchers wrote. Centralized management platforms oversee many devices or networks from a single console, and control-plane technologies route data through a network.

In Silent Train operations, the group has exploited and abused over 27 device classes. The classes include other technologies, networking infrastructure, identity and access management systems, enterprise management tools and edge devices (devices at the boundary of a network). Researchers said the group breached devices and technologies from Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto Networks, ServiceNow, TP-Link, Netgear and ArcGIS.

Confirmed zero-day campaigns targeted Versa Director, N-Able N-Central, Cisco Catalyst SD-WAN and VeloCloud Orchestrator, Black Lotus Labs observed. Zero-days are unknown software flaws for which no patch is available. The group exploited weaknesses, including zero-days, in network edge devices using short-lived compromised infrastructure. The group used this chain to gain deeper, persistent access into victim networks.

Horka, the lead researcher, said individual chains are built and taken down daily while infrastructure is continually refreshed. The group can construct a new chain using different infrastructure in under two minutes. Black Lotus Labs saw infrastructure built in under two minutes and sessions averaging roughly four hours, plus extensive cleanup, compartmentalization and new access vectors. At any given moment, the number of active nodes is effectively close to zero.

Horka said considerable effort goes into making operations difficult to discover and trace rather than into reaching end targets. Horka said particular device types were consistently assigned to specific positions in the chain. The operation resembled an organized inventory of capabilities rather than randomly compromised devices. Black Lotus Labs called the group’s investment in operational security and access preservation remarkable.

U.S. and global authorities warned about a widespread shift by Chinese hacking groups toward covert networks on compromised common devices.

Silent Train’s ephemerality and operational discipline mean it cannot be measured in size. Horka said the lack of a single network makes Silent Train fundamentally difficult to disrupt. Horka said the infrastructure in use today will be completely different tomorrow. Horka said it is much harder to stop the actor from continuously rebuilding infrastructure than to remove individual pieces.

Horka said the framework’s ephemeral nature means observations are not a complete census of Volt Typhoon activity.