Volt Typhoon

Reported Context (34)

The article attributes the Silent Train covert access network and its zero-day exploitation campaigns to Volt Typhoon. Black Lotus Labs Links Volt Typhoon to Silent Train Network Used in Zero-Day Campaigns
Described in the article as a China-government backed hacking group. Researchers said it used chains of compromised devices, exploited vulnerabilities including zero-days, and maintained access to victim networks. Volt Typhoon Rotates Ephemeral Infrastructure to Preserve Access, Researchers Say
The article reports that Volt Typhoon used the Silent Train relay framework, compromised devices to conceal attack origins, and exploited zero-day vulnerabilities against high-value targets. Volt Typhoon Uses ‘Silent Train’ Relay Framework in Zero-Day Attacks
The report cites CISA and intelligence agencies confirming targeting of critical infrastructure and access maintained in some networks for years. Zscaler VPN Risk Report Highlights Patching, Inspection and Containment Gaps
Compromised Sierra Wireless Airlink gateways and pivoted to engineering workstations, manipulating software to extract configuration and alarm data. Dragos designated it a Stage 2 group. Dragos 2026 OT Security Report Details Threat Groups Mapping Industrial Control Loops

CVE (46)

Malware (69)

People (29)

Threat Actors (150)

MITRE ATT&CK (83)

Vendors (77)

Products (157)

Tools (51)

Industries (76)

Countries (62)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.