DEV Community

Anoymask
Anoymask

Posted on

Silent Train: Volt Typhoon's Relay Chains and Disposable SSH Infrastructure

#security #threatintel

1. Basic Information

2. Executive Summary

Lumen Black Lotus Labs reported an operational framework dubbed "Silent Train," used by activity assessed as Volt Typhoon. The framework uses 4 to 6-hop chains made up of VPSs and compromised devices, starting at external VPSs and passing through non-U.S. SOHO/IoT devices and U.S.-based systems, exploiting vulnerabilities in the relay devices to deploy temporary SSH access, keys, and configurations, and then wiping traces on the relays after performing actions on high-value centralized management planes.

Because this framework combines initial access via multiple zero-day vulnerabilities with multi-hop relaying and post-operation artifact cleanup, it is likely to evade single-point monitoring on boundary devices and centralized management infrastructure. Therefore, caution is required.

3. Attack Flow

Intrusion from Multi-Hop Relays to Management Planes

Attack Phase Attacker Action / Technique Tools / Communication Path Defensive Indicators (Prerequisites / Artifacts)
1. Multi-Hop Relay Chain Setup Starting from an external VPS, connects compromised non-U.S. SOHO/IoT devices and U.S.-based systems to form a 4 to 6-hop relay chain. External VPS, over 27 classes of SOHO/IoT and enterprise devices. Note that boundary logs from a single organization cannot directly reveal the full 4 to 6-hop chain spanning multiple organizations.
2. Relay/Target Exploitation & Temporary Config Deployment Exploits device vulnerabilities as needed to deploy temporary SSH enablement, keys, configurations, or reverse tunnels. Temporary SSH daemon/keys, Chisel, FRP Addition of unknown SSH keys on boundary devices, configuration changes, startup of Chisel/FRP processes.
3. High-Value Management Plane Operations Reaches and operates target centralized management consoles or control planes through the relay chain (some enterprise environments held for 1 to 3 months). Management interfaces, control-plane communications Unexpected incoming sessions or management operations targeting the centralized management infrastructure.
4. Temporary Config & Artifact Deletion Cleans up temporarily deployed SSH settings, keys, and configurations after completing operations, closing the relay path. Short sessions averaging about 4 hours (some lasting only minutes). Chronological changes where configurations are deleted minutes to hours after being added.
  1. The attacker connects from an external VPS to a compromised non-U.S. SOHO/IoT device.
  2. Additional compromised devices, including those in the U.S., are added to form a 4 to 6-hop relay chain consisting of the VPS and compromised devices.
  3. Vulnerabilities in relay and target devices are exploited as needed.
  4. Temporary SSH services, public keys, configurations, or reverse tunnels using Chisel/FRP are deployed on the devices.
  5. Access and operations are conducted against the target organization's high-value centralized management consoles or control planes through the configured relay chain.
  6. After completing operations, temporary SSH settings and keys that serve as artifacts are deleted to end the session.

4. Attacker Location and Execution Environment

  • Attackers connect through external VPSs and compromised devices in multi-hop chains. Across the reported infrastructure, Lumen observed more than 27 classes of SOHO/IoT and enterprise devices; this is not the number of hops in an individual chain.

5. Victim and Administrator Visibility

Victims

  • General users may not notice clear screen changes or service interruptions.

Administrators

  • May observe short-lived SSH enablement on boundary devices, addition of unknown SSH keys, configuration file changes, startup of reverse tunnel processes (Chisel/FRP), and communications with unusual relay destinations.

6. Success and Failure Conditions

Success Conditions

  • Network reachability to exploitable boundary devices or SOHO/IoT devices.
  • Reachability from the configured multi-hop relay path to the target's management interface or internal services.

Failure Conditions and Mitigations

  • Block unnecessary external access to management interfaces, and apply vendor-patched firmware alongside strong authentication. Note that monitoring configuration integrity is a supplementary detection measure and does not prevent intrusions by itself. Furthermore, unknown zero-day vulnerabilities cannot be uniformly prevented by existing mitigations alone.
  • Restrict outbound communications and enforce execution controls on tunneling binaries to impede subsequent relaying and reverse tunnel establishment.

7. Impact of Successful Exploitation

Lumen highlighted CVE-2025-8875/CVE-2025-8876 in N-able N-Central, CVE-2026-20127 in Cisco Catalyst SD-WAN, and CVE-2026-16812 in VeloCloud Orchestrator as examples of observed campaigns. Additionally, zero-day exploitation against Quest KACE is assessed with "medium confidence." These associations are based on Lumen's observation activities, and exact affected versions and patches for each product must be verified via product-specific advisories.

  • Boundary devices may be used as footholds or relay points to reach high-value centralized management interfaces.
  • The details of the reported operational techniques are based on Lumen's observation scope and cannot be directly generalized to all Volt Typhoon activity.

8. Observable Logs

Inference: The following are candidate logs to examine within your organization. Their availability depends on collection, retention, and product support, and they are distinct from observation records reported by threat intel sources.

  • Email: No relevant information.
  • Proxy / SWG / DNS: Inspect destination addresses and resolution targets directly obtainable from existing proxy and DNS logs. However, single-organization logs alone may not reveal the entirety of relay chains spanning multiple organizations.
  • Endpoint / EDR: Check for configuration changes in management daemons, additions of SSH keys or accounts, execution of Chisel/FRP, and history of rapid configuration creation and deletion.
  • Identity / IdP: Check management accounts for access from unusual sources or short-lived successful authentication events.
  • SaaS / Cloud: Verify the establishment of unknown sessions against centralized management consoles or control planes.
  • Network: Examine connections and outbound reverse tunnels visible at your organizational boundary. Note that metrics such as "4 to 6 hops" and "averaging ~4 hours (some minutes)" are observed via Lumen's broad telemetry and cannot necessarily be fully reconstructed using single-boundary NetFlow alone.

9. Attack Success Assessment

  • Attack Attempt Observed (Success Unconfirmed) (contact_only): Criteria: Vulnerability scans or connection attempts to management ports from unknown sources do not confirm successful intrusion. Target: Target devices.
  • Initial Execution Confirmed (initial_execution): Criteria: Confirmed by the creation of temporary SSH/keys/configurations, startup of tunnel processes, or execution of unauthorized commands on target devices. Target: Boundary devices.
  • Follow-on Compromise Confirmed (follow_on_compromise): Criteria: Confirmed reach from relay chains to high-value centralized management planes, followed by operations against configurations, credentials, or internal assets. Target: Internal management infrastructure.

10. Investigation Playbook

  • Trigger: Detection of unknown SSH keys on boundary devices, configuration diffs, FRP/Chisel detection, or short-lived suspicious management sessions.
  • Initial Checks: Verify target assets, firmware versions, external exposure of management planes, configuration backups, NTP time synchronization, and NetFlow retention status.
  • Endpoint Investigation: Acquire and preserve device accounts, SSH keys, daemons, startup configurations, volatile file systems, and reboot history.
  • Identity and Cloud Investigation: Review authentication history for management accounts and centralized management consoles.
  • Follow-on Investigation: Investigate whether internal network connections or access to sensitive information occurred using the target device as a stepping stone.
  • Containment: Isolate management interfaces, rotate credentials and keys, update firmware, and rebuild from known good configurations.
  • Classification: Record findings clearly separated into "Scanning Only," "Initial Execution on Device," "Relay Established," and "Compromise of Internal Management Plane."

11. Defense and Detection Ideas

  • Single Event: Detect unknown SSH key additions, temporary SSH daemon activations, or FRP/Chisel startups on boundary devices.
  • Time-Series Correlation: Correlate events on the same device where configuration additions are followed by communications lasting minutes to hours, culminating in configuration deletion.
  • Threat Hunting: Pivot between NetFlow and management audit logs from both the relay origin and destination perspectives.
  • Logging Gaps: SOHO/IoT devices often lack EDR support, leading to potential gaps in periodic configuration snapshots and flow log retention.
  • Priority Controls: Prioritize external isolation of management interfaces, continuous firmware updates, configuration change monitoring, and outbound communication allowlisting.

12. Facts / Inference / Hypothesis

Facts

  • Black Lotus Labs reported issuing hundreds of victim notifications over approximately three years of tracking, observing exploitation involving at least four confirmed zero-days and one probable zero-day.
  • Attack sessions utilized 4 to 6-hop relay chains consisting of VPSs and compromised devices, reaching targets from external VPSs through non-U.S. SOHO/IoT devices and U.S.-based systems.
  • Operations involved temporarily deploying SSH services, keys, and configurations upon intrusion and deleting them afterward. Average session duration was approximately 4 hours, with some lasting only minutes.
  • Over 27 device classes were used for relaying, including 2025 campaigns maintaining access to enterprise platforms for 1 to 3 months and the use of Chisel/FRP for reverse tunneling.

Inference

  • Inference: Relying solely on individual IOC matching on boundary devices risks overlooking disposable relay paths unless short-lived configuration changes, SSH activations, and inbound/outbound relay relationships are correlated chronologically.

Hypothesis

  • No additional hypotheses. Unconfirmed items are recorded under "Uncertainties and Limitations."

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1090.003 Multi-hop Proxy high Reports indicate 4 to 6-hop relays using VPSs and compromised devices.
T1572 Protocol Tunneling high Reverse tunneling using Chisel and FRP is reported.
T1070.009 Clear Persistence medium Corresponds to operations deleting temporary SSH, keys, and configurations after actions.

14. Uncertainties and Limitations

  • While Lumen lists campaigns against Quest KACE (estimated zero-day with medium confidence), Versa Director, N-able N-Central, Cisco Catalyst SD-WAN, and VeloCloud Orchestrator, root causes, affected versions, and patch details are not exhaustively covered for every case.
  • The proportion of notified organizations where initial intrusions or relay usage progressed to achieving ultimate objectives remains unknown.

15. Impact on SOCs and Organizations

Organizations operating critical infrastructure or overseas branches should assess whether SOHO/IoT and boundary devices could be abused as relay nodes as well as final targets. In Lumen's reported topology, the intermediate infrastructure included non-U.S. relay nodes. Prioritize checking for short-lived management configuration changes and suspicious cross-border management communications or reverse tunnels.

16. Summary by Role

  • SOC: Correlate configuration diffs on boundary devices, added/deleted SSH keys, reverse tunnels (Chisel/FRP), and short-duration communications, avoiding judgments of successful compromise based solely on matching a single IP.
  • Administrators: Isolate management interfaces from the internet, register unmanaged SOHO/IoT devices in asset inventories, and enforce firmware updates and configuration change audits.
  • Users: Since screen changes may not be directly visible to standard users, configuration and log investigations by device administrators are required.

Top comments (0)