Discover how the Volt Typhoon espionage group operates Silent Train, a covert network leveraging compromised SOHO and IoT infrastructure across multiple zero-day campaigns.
According to a report by Lumen Technologies Black Lotus Labs, Silent Train was first detected in late 2023. This system leverages chains of compromised home, business, and smart devices that constantly change, using techniques to hide and clean up traces after each operation to make detection difficult.
Which organizations were affected?
The main goal of this network is to facilitate critical stages of an attack, such as exploiting security vulnerabilities, stealing credentials, and maintaining long-term access to victims. The group targeted organizations that could provide access to wider networks, such as telecommunications providers, government agencies, defense contractors, satellite services, universities, technology companies, and critical infrastructure, including water, energy, transportation, and emergency services.
Attacks on critical systems
The Volt Typhoon group has been active since at least 2021 and has been repeatedly linked to attacks on critical infrastructure. Recent research has shown that Silent Train was used in at least four attacks exploiting previously unknown security vulnerabilities, including issues in network management platforms and control devices such as N-able N-central, Cisco Catalyst SD-WAN Controller, and Arista VeloCloud Orchestrator, as well as older attacks such as Versa Director. In addition, the group is believed to have exploited a vulnerability in Quest KACE before it was patched in October 2025, affecting more than 30 victims.
How the hiding network worked
The Silent Train network was designed to have traffic pass through multiple devices before reaching its final target, hiding the true origin of the attack. The attackers used temporary systems, compromised devices outside the United States to hide the origin, and devices inside the United States as exit points.
↳
READ ALSO
HACKS.GR / RELATED
Cyber Attacks & Data Breaches
Dream reports that attackers took control of 25 devices, three in an environment linked to a US organization
↗
By early 2025, the network had evolved from a constantly changing infrastructure to a hybrid model that retained some key devices for longer periods of time, using open data transfer tools. In the United States, operations were particularly focused on states such as Hawaii, California, and Texas, due to the presence of major military installations, communications infrastructure, and critical freight networks.
G
HACKS.GR / GOOGLE SEARCH
Hacks.gr on Google
Set Hacks.gr as a preferred source.
Preferred source
↗
end of article
Top comments (0)