Volt Typhoon Exploits Disrupted 'Silent Train' Covert Network in Zero-Day Campaigns

The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been put to use for zero-day exploitation and strategic access. First identified in late 2023, Silent Train uses rotating chains of compromised SOHO, IoT, and enterprise infrastructure. Lumen Technologies Black Lotus Labs said in a report that the network has been disrupted, but residual risk remains from previously compromised infrastructure. The deployment of Silent Train enables zero-day exploitation and poses significant risk to critical and organizational networks globally. The exact scope of zero-day exploits, specific victim counts, and full extent of the disrupted network are based on reported findings and may require further validation. Mitigation involves disrupting the Silent Train network, securing SOHO/IoT devices, and applying security advisories from Lumen Technologies Black Lotus Labs.