Silent Train: Volt Typhoon's Sophisticated Infection Chain into US Targets Exposed

For several years, researchers and government officials have described the Volt Typhoon intrusions into US critical infrastructure in superlative terms.

The state hacking group from China, which has methodically and strategically breached US critical infrastructure since at least 2023 — some say in preparation for attacks against these systems should China invade Taiwan — has been called extremely stealthy and ultra-sophisticated. Former FBI Director Christopher Wray referred to them, along with other Chinese state- hacking groups, as the “defining threat of our generation.”

Yet researchers and government officials have provided little evidence to support the hyperbolic descriptions of this group and its activity.

Today, security researchers are finally revealing some of the sophisticated tactics Volt Typhoon attackers have been using for years to gain access to high-profile targets to steal credentials, siphon data and establish persistence inside these networks. The targets include an array of victims across numerous sectors in the US, but the nature of the victims and their concentration in specific geographical regions supports theories that Volt Typhoon has chosen them for strategic military reasons.

Researchers at Lumen Technologies’ Black Lotus Labs — which has played a critical role in tracking the group since its discovery three years ago — have released a report on Silent Train, a covert and constantly evolving network, or daisy chain, of compromised devices (including SOHO routers and internet-of-things devices) that Volt Typhoon uses to rapidly slip into and out of the high-profile networks they’re actually targeting. The hackers often remain inside a network for just a few hours or minutes, then erase all tracks of their activity before the victims realize they’ve been breached.

Each daisy chain of compromised devices, located outside and inside the US, is used just once to gain entry to a single target, then discarded and replaced by a new chain of other compromised devices to attack other targets or even to attack that same target at a later date.

These tactics have made it difficult for victims and threat intelligence researchers to detect them while they’re still in a network or trace their path to the targeted network once all artifacts have been erased.

These stealth methods demonstrate extreme patience and discipline, says Mike Horka, principal information security engineer at Black Lotus Labs, who gave a nonpublic talk Silent Train recently at SentinelOne's Labscon security conference in Arizona and authored the public report released today.

“This is not something that we have seen before on this scale and not with this level of operational security,” says Horka. “There’s an operational structure with Silent Train… which is very, very rare.”

The researchers have notified hundreds of victims over the three years they have tracked the Silent Train infections of Volt Typhoon. The targets include US government agencies and defense contractors, telecoms, emergency communication providers, and entities involved in sensitive law enforcement and military communications, geospatial intelligence gathering, and the operation of low earth orbit satellites. They have also included universities engaged in military research or that have ROTC programs and other military relationships.

But in addition to these, Volt Typhoon has targeted managed service providers and IT providers — presumably for the privileged access they have into customer devices and networks — as well as critical infrastructure operators in the energy, water, rail, and shipping sectors, all of which provide essential services not only to civilians but also to the government and military.

Horka says the targets are diverse in nature but a common characteristic: they are all organizations that occupy positions of trust and influence or that provide connectivity and access to important customers, sensitive networks, or strategic programs that are particularly important to the military.

Government officials have characterized Volt Typhoon’s activity as “pre-positioning” for a possible conflict with Taiwan, and based on the sophistication of the intrusions and the geographical location where many of the targeted victims are concentrated, the Black Lotus Labs researchers agree.

“Across multiple years of activity, Hawaii, California, and Texas repeatedly emerged as focal points for Silent Train operations,” they write in their report.

Major military installations, telecommunications infrastructure, defense contractors, satellite communications providers, and critical logistics networks are based in these states and “support strategically significant US operations, particularly within the Indo-Pacific region,” the researchers note. The victims occupy “positions of trust and connectivity upon which military, government, and civilian operations depend” and “would be of heightened importance during geopolitical tensions or crises.”

But Horka says the breaches aren’t just pre-positioning.

“We have seen them exfiltrating documents related to military operations and structures of networks and getting credentials that can get them long-term access. I don’t think they are just trying to preposition or espionage; I think it’s a combination of the two.”

Sophisticated Daisy Chains

The researchers first uncovered Silent Train activity in 2023 while analyzing a separate covert network and uncovering unusual SSH relay chains. Covert networks are networks of compromised devices that attackers use to obfuscate their activity and thwart attribution. Generally, attackers will use a covert network repeatedly, but in the case of Volt Typhoon, the researchers found that the actors were using one-time infection chains that required a lot of work to set up, only to dismantle them after each session.

Over three years of tracking the group, they established that the hackers follow a distinct pattern in setting up their Silent Train infection chains. They begin with the attackers first infecting a virtual private server (VPS) located somewhere outside the US. They then compromise another VPS but in a different geographical region outside the US to begin laying the tracks of their infection train. Once they have done this, they pivot into the US where they infect a so-called SOHO (small office/ office) router or internet-of-things device on their way to their actual target.

The attackers work rapidly, often assembling a Silent Train attack chain in less than two minutes — suggesting that parts of their activity is automated — and the types of devices they compromise in the early hops outside the US are never the same types of devices they compromise for later hops inside the US, and vice versa.

Horka says this is likely to thwart the visibility of defenders and investigators. The maker of a device might have visibility for all of their devices used globally, but if the attackers only compromise those specific devices in Europe and not in the US, the maker won’t see beyond those European infections as the attackers move to other device types in different regions and inside the US. This makes it difficult for any one to see the entire infection chain at a glance.

The VPSes are used as a temporary staging area and the other infection hops outside the US are used to add geographic and device diversity to obscure their origin and confuse anyone trying to track them. The devices compromised inside the US, before the attackers hit their end targets, are designed to help the malicious traffic blend into normal internet traffic and avoid firewall protections that block traffic coming from specific geographic locations or IPs.

“Together, these layers compartmentalized operations, hindered attribution, and made it difficult to trace activity back through the entire chain,” the researchers write.

The attackers didn’t always stick with the same types of devices to compromise, and the attackers introduced a new device type into their infection chains once a month. The intrusion chains the researchers tracked involved more than 27 different classes of devices, including TP-Link and Netgear routers used in small offices and offices. They also, however, compromised enterprise platforms — including Fortinet, Cisco, PRTG, Mirth Connect, and CyberPanel — which were often used at the end of their infection chain in the US, before they breached their end targets.

“Unlike the ephemeral SOHO and IoT infrastructure used only for specific operations, these enterprise-grade devices remained compromised and available in Silent Train for an average of one to three months,” the researchers note. “Instead of supporting a single engagement, they reused [these] same hops across several intrusion operations before replacing them.”

Device types were strictly used for specific roles in the infection chains. For example, they only infected Intelbras modems if they were located outside the US and only infected Netgear Orbi devices that were located inside the US.

When they finally reached their targets, the attackers often compromised management systems that administrators use to centrally manage their networks.

“These systems provide administrative access to many devices, detailed asset inventories, network visibility, and remote management, and they act as centralized trust points for enterprises and downstream customer environments,” the researchers note.

Many of the devices they targeted have known vulnerabilities for which patches are available. But the researchers found at least four zero day vulnerabilities used in Silent Train breaches.

The attackers rarely deposit malware on infected systems, instead hijacking existing tools on the network in a manner called “living off the land” to avoid detection.

And once they complete their intrusion inside a targeted network, they rapidly erase all traces of their activity inside that network — including erasing or altering logs. They do the same across the entire infection chain that they used to get into that network, restoring each compromised device to its former state.

“At the end of operational sessions, they removed every artifact and dismantled the operational chain in their wake,” leaving “no evidence for defenders to uncover,” the researchers note in their report.

If you find this article valuable, you can leave a one-time tip to express appreciation to the author.

When Volt Typhoon’s activity was first publicly disclosed, owners and operators of critical infrastructure expressed frustration that they weren’t given technical details to help them detect the intruders in their networks. But Silent Train’s operations show that there is often little left behind to help them find the attackers in their networks.

When the attackers return to a targeted network, they often use legitimate employee credentials that they stole during their initial session inside the network as well as a different chain of compromised systems to reach the target.

“They might return in 30 days for a 2-hour session and a month later for 6 hours,” says Horka. But each time they return, they “use a different set of hops” to get in.

One of their primary goals, the researchers say, is to obtain and preserve access across a wide swath of systems and organizations in a manner that gives them broad visibility, reach and control across a broad ecosystem. And Silent Train, the researchers say, is the highly structured framework they have built to acquire and sustain that strategic access at scale.

“Through repeated targeting of centralized management platforms and control plane technologies, Silent Train shows how Volt Typhoon systematically pursues and preserves access to some of the most consequential networks in the United States.”