A Chinese cyber espionage group called Volt Typhoon operated a covert network known as Silent Train that was discovered and disrupted. The network used rotating chains of compromised devices from small office and home office equipment, internet-connected devices, and enterprise infrastructure to conduct zero-day exploitation campaigns. Identified in late 2023, Silent Train employed techniques to hide its activities and was used to facilitate critical attack phases including vulnerability exploitation, credential access, and data theft. Hundreds of victims across telecommunications, government, defense, satellite services, universities, and critical infrastructure sectors such as water, energy, and transportation were identified.
The network operated as a multi-layered system routing malicious traffic through virtual private servers and compromised devices across multiple countries before reaching targets in the United States. At least 27 different device classes were exploited and enrolled into the network. Sessions typically lasted around four hours on average, with operators removing all traces after each operation. By early 2025, the platform had evolved to retain enterprise devices for one to three months rather than discarding them after each use. Operations focused on states including Hawaii, California, and Texas that host military installations and critical infrastructure.
Source: Read the full story at The Hacker News
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
