{"id":10220,"date":"2026-10-30T00:10:15","date_gmt":"2026-10-30T00:10:15","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=10220"},"modified":"2026-10-30T00:10:15","modified_gmt":"2026-10-30T00:10:15","slug":"a-deep-dive-into-chinas-volt-typhoon-suggests-it-is-preparing-for-an-assault-on-infrastructure","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=10220","title":{"rendered":"A deep dive into China\u2019s Volt Typhoon suggests it is preparing for an assault on infrastructure"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

In a deep dive into the Silent Train attack tactic used by China\u2019s Volt Typhoon cybercrime group, Lumen\u2019s Black Lotus Labs highlighted evidence of efforts to pre-position access within what it described as \u201cstrategic communications, critical infrastructure and other ecosystems that become essential during geopolitical tensions or crises.\u201d\u00a0<\/p>\n

The report, released on Wednesday, said that Silent Train is built around \u201crapidly rotating chains of compromised SOHO, IoT and enterprise devices that are exploited on demand, used against carefully selected targets, cleaned up after each operation and continuously refreshed. This approach allowed Volt Typhoon to carry out exploitation and post-exploitation activity securely while reducing the risk of detection, attribution, and disruption.\u201d<\/p>\n

Multiple intrusions via Silent Train have been confirmed in the wild, Lumen said, all on high value targets.<\/p>\n

Its report described<\/a> at least four confirmed and one likely zero-day vulnerabilities exploited by Volt Typhoon, which targeted network and endpoint management systems, SD-WAN orchestrators and control plane infrastructure that provide visibility, administration and access across enterprise and customer environments. It noted that victims included telecommunications providers, government, defense contractors, satellite and mission-critical communication services, universities, IT firms and critical infrastructure such as water, energy, transportation, maritime, rail, aviation, emergency services and other essential operations.<\/p>\n

Lumen said the nature of these victims \u201cindicates deliberate efforts to maintain access to critical ecosystems that support defense, logistics, communications, military and civilian operations, especially during heightened tensions or crises in the Indo-Pacific region.\u201d<\/p>\n

Although the Silent Train attack has been in the wild for years and was tracked by various cybersecurity teams, the level of operational details that Lumen reported Wednesday went well beyond what had been known.\u00a0<\/p>\n

In fact, Frank Dickson<\/a>, principal analyst at Dickson Research, who tracks this space, said the Lumen report \u201cmay be one of the most valuable pieces of research published this year.\u201d<\/p>\n

Key findings<\/h2>\n

Some of the report\u2019s key findings described the surprising speed and efficiency of the attacks.\u00a0<\/p>\n

\u201cSessions were often remarkably efficient. Operators could exploit and assemble chains of devices in under two minutes, and on their way out they would leave no evidence for defenders to uncover,\u201d Lumen said. \u201cTheir operational tempo suggests the use of a semi-automated, on-demand provisioning process.\u201d But a strict process remained consistent throughout many attacks, it pointed out.<\/p>\n

\u201cAnother noteworthy aspect was Volt Typhoon\u2019s consistent assignment of specific device types to positions within Silent Train chains,\u201d the report said. \u201cWe noticed that device types were reserved for specific operational roles that never deviated. Intelbras modems only appeared as overseas relay nodes, while Netgear Orbi devices served as US-based hops that interacted with victims. Similar patterns appeared across every other device type in Silent Train.\u201d<\/p>\n

It observed that, despite having enough global infrastructure to swap device types between overseas and US hops, Volt Typhoon maintained these fixed roles throughout three years of monitoring, and its VPS infrastructure also used separate providers and locations rather than a shared environment.<\/p>\n

The report concluded that attack infrastructure \u201cwas deliberately compartmentalized across layers, complicating attribution and reducing the risk that access to one device or provider would expose more of the network. The underlying infrastructure changed constantly, but the architecture and role of each layer remained highly structured.\u201d<\/p>\n

Laying the foundation<\/h2>\n

Analysts and consultants noted that the attacks didn\u2019t necessarily engage in damage or theft initially, but instead laid a foundation for a later attack.<\/p>\n

\u201cI wouldn\u2019t say this is necessarily a novel approach, but it is a clever one,\u201d said Sav Wheeler<\/a>, malware research engineer at Malwarebytes. \u201cHolding off on taking advantage of compromised resources until an opportunity presents itself is itself a strategic form of resource management.\u201d<\/p>\n

Mike Wilkes<\/a>, enterprise CISO at Aikido Security, agreed that the delayed gratification is a dangerous attack group tactic.<\/p>\n

\u201cP0wning th,e control plane of telecommunications and critical infrastructure is both logical and, sadly, often rather easy\u201d he said. \u201cWhy attack individual systems when you can compromise the infrastructure that manages, connects and authenticates them? The strategic objective isn\u2019t necessarily immediate disruption. It\u2019s establishing the ability to disrupt, manipulate or deny services at a time of geopolitical advantage.\u201d<\/p>\n

Dickson also agreed, saying that the published details show a pattern that \u201cis not espionage for its own sake. It looks like access being banked for a crisis in the Pacific.\u201d<\/p>\n

Rethink defenses<\/h2>\n

\u201cThat breaks the usual defender playbook,\u201d Dickson said. \u201cA blocklist does nothing against an address that was a relay for four hours last Tuesday. The indicators expire before anyone can publish them. This is also a direct response to the KV-botnet takedown<\/a>. Take out the bridge and they build a ferry.\u201d\u00a0<\/p>\n

He added, \u201ca network management console is built to see everything, reach everything, and change everything. Those are exactly the powers an attacker wants. We spent a decade building higher castle walls and then hung the master key ring by the gate.\u201d<\/p>\n

But it is the speed of Silent Train that worries Dickson the most. Although an enterprise can\u2019t out-rotate an adversary that rebuilds its network in two minutes, \u201cit can make the destination much harder to reach. Take every management console, SD-WAN orchestrator, and admin portal off the open internet and put it behind a VPN, a jump host, or a dedicated management network. Patch control plane technology first, not last,\u201d he advised.<\/p>\n

Aman Mahapatra<\/a>, chief strategy officer for New York City-based technology consulting firm Tribeca Softech, said the implications of the Silent Train deep dive will force CISOs to rethink much of their defensive strategies.\u00a0<\/p>\n

\u201cIP-based defenses are nearing the end of their usefulness against this class of adversary. When the network origin is disposable, identity, behavior, and timing are what remain visible,\u201d he said. \u201cAn adversary willing to burn an exploit on a router to protect an exploit on an SD-WAN orchestrator is telling defenders exactly how much that access is worth.\u201d<\/p>\n

Another concern, said Mahaptra, is revealed by the way Lumen was able to detect much of the attack methodology, something that will likely elude most enterprise SOCs.\u00a0<\/p>\n

\u201cLumen detected Silent Train because a backbone carrier can see the entire chain,\u201d Mahapatra said. \u201cNo single enterprise ever sees more than its own segment. Organizations in the sectors on this victim list should formalize threat notification arrangements with their carriers, because the detection that worked here happened outside every victim\u2019s network.\u201d<\/p>\n

He advised enterprises to also watch their own edge devices for outbound behavior. Lumen documented FortiGate and Cisco appliances, PRTG, CyberPanel and even Mirth Connect healthcare integration servers serving as final hops, some for one to three months, he pointed out; outbound SSH to unfamiliar hosts, reverse tunnels built with tools such as Chisel or FRP, and traffic on unusual high ports \u201ccan indicate that a company\u2019s appliance is serving as the attacker\u2019s domestic face for an intrusion elsewhere.\u201d<\/p>\n

Mark Child<\/a>, an associate research director with IDC, also is concerned about the tactical methods of Silent Train.<\/p>\n

\u201cSilent Train abandons persistence,\u201d Child said. \u201cInstead of maintaining a permanent network, Volt Typhoon rapidly assembles and dismantles transient infrastructure. This makes it more effective against network-centric defenses: IP blocklists, threat-intel feeds of IOC addresses, geofencing, and takedowns. Those all assume infrastructure that sticks around.\u201d<\/p>\n

However, he noted, \u201cit is not more effective against good endpoint and behavioral detection on the target.\u201d No matter many hops there are, the exploitation, credential theft and admin-tool abuse still execute on the server. <\/p>\n

\u201cThe real force multiplier is the choice of target,\u201d he said. \u201cHitting a management platform delivers admin access to thousands of devices and trusted paths to downstream customers, with no lateral movement, which removes the lateral movement signals EDR usually relies on. For endpoint security teams, IP-based detection loses value here. Behavioral monitoring of privileged management servers, and what they do to endpoints, becomes the decisive control.\u201d<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

In a deep dive into the Silent Train attack tactic used by China\u2019s Volt Typhoon cybercrime group, Lumen\u2019s Black Lotus Labs highlighted evidence of efforts to pre-position access within what it described as \u201cstrategic communications, critical infrastructure and other ecosystems that become essential during geopolitical tensions or crises.\u201d\u00a0 The report, released on Wednesday, said that […]<\/p>\n","protected":false},"author":0,"featured_media":10221,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-10220","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10220"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10220"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10220\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/10221"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10220"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10220"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10220"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}