Volt Typhoon Used Silent Train in Zero-Day Campaigns

Lumen Technologies’ Black Lotus Labs says the Volt Typhoon hacking group used a covert network called Silent Train to exploit at least four zero-day vulnerabilities and target sensitive organizations, including those in telecommunications, government, defense and critical infrastructure. The researchers describe Silent Train as rapidly assembled chains of compromised small-office routers, internet-connected devices and enterprise systems. The devices relay activity toward selected targets, then are cleaned up and replaced after operations, making the infrastructure difficult to track. Black Lotus Labs said the findings reflect its observations and are not a complete census of the group’s activity. According to the lab, operators used Silent Train in confirmed campaigns involving vulnerabilities in network and management systems, including software that controls enterprise networks. Researchers also assessed a case involving Quest KACE as a likely zero-day. The systems targeted can provide broad administrative access, potentially allowing attackers to reach connected environments without moving step by step through a victim’s network. Black Lotus Labs reported that some chains...