Volt Typhoon hacking group linked to covert Silent Train network

Researchers at Lumen’s Black Lotus Labs have identified a covert network, dubbed ‘Silent Train,’ used by the China-linked hacking group Volt Typhoon. The network was utilized in four confirmed zero-day campaigns targeting software designed to manage entire networks rather than individual computers.

By compromising these management platforms, attackers could potentially gain access to critical infrastructure, including telecommunications, defense, energy, transportation, and water resources. The Silent Train network was specifically designed to be disposable and leave minimal traces; operators utilized compromised home-office routers and enterprise systems, breaking connections and erasing evidence once operations concluded.

The identified campaigns involved vulnerabilities in several platforms, including Versa Director, N-able N-central, and Cisco SD-WAN management systems. The group showed particular interest in targets located in Hawaii, Texas, and California.