China's 'Volt Typhoon' quietly built another hacking network following US crackdown, new ...

In January 2024, a quartet of U.S. cyber and intelligence officials issued a stark public warning Chinese hackers embedding themselves into critical infrastructure around the country. Volt Typhoon, as the group is known, was targeting systems like power grids and transportation networks, positioning itself to sabotage them should the U.S. become involved in a conflict with Beijing over Taiwan, officials assessed.

The FBI at the time had just struck at a network of compromised routers used by the hackers to conceal their intrusions. The operation, conducted in December 2023 and announced the following month, disabled the main arm of the staging ground, dubbed KV Botnet, subsequent research found . It was a major disruption of the group’s infrastructure, accompanied by a public campaign to alert organizations to the threat.

But as U.S. investigators dismantled parts of KV and worked to notify victims, another Volt Typhoon operation was quietly taking shape, according to findings released Wednesday by Black Lotus Labs, the threat intelligence arm of Lumen.

That network, dubbed Silent Train, has supported a three-year campaign against government systems, telecommunications providers, defense contractors, satellite services, universities, technology firms and various critical infrastructure operators, according to the research.

Built around chains of compromised routers, corporate networking equipment and everyday internet-connected devices, Silent Train gave the hackers ways to reach targets while concealing where their activity originated. Volt Typhoon used it to target and, in some cases, compromise organizations across those sectors, according to Lumen.

Those organizations include Energy Department facilities around the U.S. that have been targeted over the last year, according to a person with knowledge of the matter. Multiple utility providers have also been dealing with Volt Typhoon-related issues over a similar timeframe, according to a former U.S. official. Both people were granted anonymity to sensitive details of recent intrusions linked to the hackers.

The findings paint a picture of how much of Volt Typhoon’s activity remained outside public view, even as the U.S. worked to expose and disrupt it, and they underscore the Chinese hackers’ persistence in gaining footholds inside American systems.

Access to organizations that supply power, communications and other vital services could give Beijing opportunities to interfere with civilian life and military operations during a crisis, a dynamic that has long been a concern of current and former officials dealing with China-linked cyber threats.

U.S. officials had cautioned early on that dismantling KV would not end the campaign. In March 2024, then-NSA cybersecurity director Rob Joyce said investigators were still finding victims of the hacking group. By May, officials detailed multiple covert networks supporting the hackers.

Lumen’s findings provide a more detailed view of one such operation. Most targets were U.S. government entities, defense contractors and universities with defense relationships. IT companies and managed service providers — firms that operate their customers’ technology infrastructure — were also prominent targets.

The hackers heavily targeted entities in Hawaii, California and Texas, a concentration Lumen believes reflected an effort to position for disruption of U.S. defense and infrastructure networks connected to the Indo-Pacific.

“Many of the organizations targeted in these areas occupied positions of trust and connectivity upon which military, government, and civilian operations depend,” the report says.

Telecom providers were among the targets reached through enterprise IT management tools. Such platforms can offer an especially valuable entry point because they are built to oversee other systems and give administrators broad access.

“Threat actors typically need to traverse networks, identify administrators, locate key systems, and establish multiple footholds to gain visibility. Volt Typhoon bypasses this by targeting management platforms directly, which already have visibility, access, and administrative functions,” the report reads.

Lumen observed more than 27 classes of devices used in Silent Train, ranging from TP-Link routers and Netgear equipment to enterprise platforms like Fortinet appliances. Some compromised devices had no known security flaws, which Lumen said suggested the hackers may have exploited previously undiscovered vulnerabilities.

Silent Train also relied on brief, carefully managed connections rather than keeping the same access paths continuously active. After conducting operations, the hackers removed traces of their activity and dismantled connection paths, according to Lumen. The access windows lasted four hours on average, with some active for only a few minutes.

The persistence of the campaign echoes a warning then-FBI Deputy Director Paul Abbate gave in August 2024 that U.S. efforts had fallen short of deterring the hackers.

Despite the government’s interventions, he said, “it just has not had the deterrent effect that we would want to see.”

Washington has also tried diplomatic pressure. Then-Secretary of State Antony Blinken and Nathaniel Fick, the State Department’s former top cyber diplomat, pressed Chinese officials to halt Volt Typhoon’s activities during an April 2024 visit to China, Fick told reporters the following month.

“Secretary Blinken was very clear that holding American critical infrastructure at risk — especially civilian critical infrastructure — is dangerous. It’s escalatory. It’s unacceptable,” Fick said at the time.