Silent Train: Infraestrutura efêmera da Volt Typhoon
Researchers have identified that Volt Typhoon, a China government backed hacking group, has infiltrated America’s critical infrastructure networks for years, building and dismantling short lived malicious infrastructure to access hundreds of sensitive systems without detection, according to Lumen Technologies’ Black Lotus Labs report.
The covert operation known as Silent Train is not a standalone network but a series of compromised small office home office routers, internet of things devices and enterprise infrastructure that the group has rapidly rotated through since late 2023.
Michael Horka, principal information security engineer at Black Lotus Labs, said that individual chains are assembled and dismantled daily, with infrastructure refreshed continuously, and that a new chain can be rebuilt with different infrastructure in less than two minutes, making the number of nodes at any moment effectively close to zero.
The report has notified hundreds of victims, including:
- telecom providers
- government entities
- defense contractors
- communication services
- universities
- IT firms
- water sector
- energy sector
- transportation sector
- maritime sector
- rail sector
- aviation sector
- emergency services
According to Horka, sessions average roughly four hours, and the group invests considerable effort in extensive cleanup, compartmentalization and development of new access vectors, focusing on making operations difficult to discover and trace rather than solely on reaching final targets.
After the FBI and Justice Department disrupted the KV Botnet in early 2024, Volt Typhoon increased reliance on Silent Train, and authorities worldwide have warned about a broader shift among Chinese hacking groups toward covert networks built on common compromised devices.
Volt Typhoon has compromised more than 27 device classes in its Silent Train operations, including edge devices, enterprise management tools, identity and access management systems, networking infrastructure and other technologies, and has conducted zero dia campaigns targeting Versa Director, N A ble N Central, Cisco Catalyst SD WAN and VeloCloud Orchestrator.
Horka noted that device diversity matters but discipline matters more, as specific device types are consistently reserved for particular positions in the chain, indicating an organized inventory of capabilities rather than random compromise.
The ephemeral nature and operational discipline of Silent Train make it fundamentally difficult to disrupt because there is no single network to remove, and the infrastructure changes completely from one day to the next, requiring continuous rebuilding by the actor.
Com informações de: CyberScoop