Volt Typhoon Rotates Ephemeral Infrastructure to Preserve Access, Researchers Say
Summary
Black Lotus Labs says Volt Typhoon’s Silent Train operation rapidly rotates compromised routers, IoT devices and enterprise infrastructure. Researchers report notifying hundreds of victims and observing zero-day campaigns, but say the activity cannot be fully measured.
Key points
- Black Lotus Labs describes Silent Train as a changing chain of compromised SOHO routers, IoT devices and enterprise infrastructure, rather than a single network.
- Researchers say Volt Typhoon can assemble a new infrastructure chain in under two minutes; sessions averaged about four hours, with extensive cleanup and compartmentalization.
- Black Lotus Labs says it has notified hundreds of victims across telecommunications, government, defense, critical infrastructure, education and IT.
- The group reportedly exploited more than 27 device classes and compromised technologies from multiple vendors.
- Black Lotus Labs observed confirmed zero-day campaigns targeting Versa Director, N-Able N-Central, Cisco Catalyst SD-WAN and VeloCloud Orchestrator.
- Researchers say activity increased after authorities disrupted the KV Botnet in early 2024, and caution that Silent Train’s ephemeral nature prevents a complete census.
Article Details
- Event Type
- Research report on Volt Typhoon’s covert network of compromised devices
- Impact
- Black Lotus Labs reported that Volt Typhoon used rapidly refreshed chains of compromised routers, IoT devices, and enterprise infrastructure to exploit vulnerabilities and maintain access to victim networks. The group has compromised devices across hundreds of organizations, including critical infrastructure, government, defense, telecommunications, and other sectors; the short-lived infrastructure makes the operation difficult to measure and disrupt.
MITRE ATT&CK
T1190 · Exploit Public-Facing ApplicationResearchers said Volt Typhoon exploited vulnerabilities, including zero-days, in network edge devices to gain deeper access to victim networks.T1584.008 · Network DevicesResearchers described Volt Typhoon using chains of compromised SOHO routers, IoT devices, and enterprise infrastructure as short-lived operational infrastructure.
People
Threat Actors
Vendors
Check PointThe threat group has successfully compromised devices and technologies from Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto Networks, ServiceNow, TP-Link, Netgear and ArcGIS, researchers said.CiscoThe threat group has successfully compromised devices and technologies from Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto Networks, ServiceNow, TP-Link, Netgear and ArcGIS, researchers said.F5The threat group has successfully compromised devices and technologies from Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto Networks, ServiceNow, TP-Link, Netgear and ArcGIS, researchers said.FortinetThe threat group has successfully compromised devices and technologies from Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto Networks, ServiceNow, TP-Link, Netgear and ArcGIS, researchers said.IvantiThe threat group has successfully compromised devices and technologies from Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto Networks, ServiceNow, TP-Link, Netgear and ArcGIS, researchers said.ManageEngineThe threat group has successfully compromised devices and technologies from Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto Networks, ServiceNow, TP-Link, Netgear and ArcGIS, researchers said.NETGEARThe threat group has successfully compromised devices and technologies from Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto Networks, ServiceNow, TP-Link, Netgear and ArcGIS, researchers said.Palo Alto NetworksThe threat group has successfully compromised devices and technologies from Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto Networks, ServiceNow, TP-Link, Netgear and ArcGIS, researchers said.ServiceNowThe threat group has successfully compromised devices and technologies from Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto Networks, ServiceNow, TP-Link, Netgear and ArcGIS, researchers said.TP-LinkThe threat group has successfully compromised devices and technologies from Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto Networks, ServiceNow, TP-Link, Netgear and ArcGIS, researchers said.
Products
ArcGISThe threat group has successfully compromised devices and technologies from Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto Networks, ServiceNow, TP-Link, Netgear and ArcGIS, researchers said.Arista VeloCloud OrchestratorBlack Lotus Labs also observed confirmed zero-day campaigns targeting Versa Director, N-Able N-Central, Cisco Catalyst SD-WAN and VeloCloud Orchestrator.Cisco Catalyst SD-WANBlack Lotus Labs also observed confirmed zero-day campaigns targeting Versa Director, N-Able N-Central, Cisco Catalyst SD-WAN and VeloCloud Orchestrator.N-able N-centralBlack Lotus Labs also observed confirmed zero-day campaigns targeting Versa Director, N-Able N-Central, Cisco Catalyst SD-WAN and VeloCloud Orchestrator.Versa DirectorBlack Lotus Labs also observed confirmed zero-day campaigns targeting Versa Director, N-Able N-Central, Cisco Catalyst SD-WAN and VeloCloud Orchestrator.
Countries
ChinaVolt Typhoon, a China-government backed hacking group that has infiltrated America’s critical infrastructure networks for years, has consistently built and dismantled ephemeral malicious infrastructure to burrow intoUnited StatesEarlier this year, U.S. and global authorities warned about a widespread shift in Chinese hacking groups’ use of covert networks riding on compromised common devices.
Industries
AviationOther victims spanning critical infrastructure include organizations in the water, energy, transportation, maritime, rail, aviation and emergency services sectors.communicationsand geographic targeting observed throughout our investigation point to a sustained focus on communications, defense, government, and critical infrastructure environments of enduring strategic value,” BlackCritical infrastructureVolt Typhoon, a China-government backed hacking group that has infiltrated America’s critical infrastructure networks for years, has consistently built and dismantled ephemeral malicious infrastructure to burrow intoDefenseBlack Lotus Labs has notified hundreds of victims since it first identified Silent Train activity, including telecom providers, government entities, defense contractors, communication services, universities and IT firms.Emergency ServicesOther victims spanning critical infrastructure include organizations in the water, energy, transportation, maritime, rail, aviation and emergency services sectors.EnergyOther victims spanning critical infrastructure include organizations in the water, energy, transportation, maritime, rail, aviation and emergency services sectors.GovernmentVolt Typhoon, a China-government backed hacking group that has infiltrated America’s critical infrastructure networks for years, has consistently built and dismantled ephemeral malicious infrastructure to burrow intoMaritimeOther victims spanning critical infrastructure include organizations in the water, energy, transportation, maritime, rail, aviation and emergency services sectors.railOther victims spanning critical infrastructure include organizations in the water, energy, transportation, maritime, rail, aviation and emergency services sectors.TransportationOther victims spanning critical infrastructure include organizations in the water, energy, transportation, maritime, rail, aviation and emergency services sectors.waterOther victims spanning critical infrastructure include organizations in the water, energy, transportation, maritime, rail, aviation and emergency services sectors.