Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns
Summary: Lumen Technologies Black Lotus Labs attributed the China-nexus group Volt Typhoon to a covert access network called Silent Train, first identified in late 2023, which uses rotating chains of compromised SOHO, IoT, and enterprise devices to conduct zero-day exploitation and maintain access. The report ties four confirmed zero-day campaigns to Silent Train, including the Versa Director flaw CVE-2024-39717 used to deliver the VersaMem web shell, and identifies hundreds of victims across telecommunications, government, defense, satellite, university, IT, and critical infrastructure sectors. Silent Train sessions lasted about four hours on average, with some lasting only minutes, and by early 2025 the network shifted to a hybrid model retaining enterprise-grade devices for one to three months.
Why it matters: Hundreds of victims have already been identified across defense contractors, satellite and mission-critical communications providers, and water, energy, and transportation infrastructure, with Hawaii, California, and Texas as U.S. focus areas because they host major military installations and logistics networks. The group's discipline of dismantling each chain after use and confining device types to fixed roles is built specifically to deny defenders the attribution and detection opportunities that persistent infrastructure would leave behind.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2024-39717
- Related
- CVE-2024-39717: Versa Director Dangerous File Type Upload Vulnerability Known Exploited Vulnerabilities · Aug 23, 2024New 0-Day Attacks Linked to China’s ‘Volt Typhoon’ Cyber Risks ·