Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns

The China-linked cyber espionage group Volt Typhoon has been linked to a covert access network called Silent Train, which was used in four zero-day exploitation campaigns. First identified in late 2023, Silent Train relies on rotating chains of compromised SOHO routers, IoT devices, and enterprise infrastructure to maintain stealthy access. The network has since been disrupted. Lumen Technologies Black Lotus Labs published a report attributing this infrastructure to Volt Typhoon. The campaigns focused on strategic access, consistent with Volt Typhoon's known mission of pre-positioning within critical networks. This activity underscores the group's continued use of living-off-the-land techniques and covert proxy infrastructure to evade detection.