Volt Typhoon
Threat actorNames and who uses them
- Volt TyphoonOur name
- DEV-0391CISA
- Insidious TaurusCISA
- UNC3236CISA
- Vanguard PandaCISA
- VoltziteCISA
- DazedToadMITRE ATT&CK
- BRONZE SILHOUETTESecureworks
Targets
Sectors: Critical infrastructure
Regions: United States
Source: MITRE ATT&CKKnown techniques
- T1003.001LSASS Memory
- T1003.003NTDS
- T1005Data from Local System
- T1006Direct Volume Access
- T1007System Service Discovery
- T1010Application Window Discovery
- T1012Query Registry
- T1016System Network Configuration Discovery
- T1016.001Internet Connection Discovery
- T1018Remote System Discovery
- T1021.001Remote Desktop Protocol
- T1027.002Software Packing
- T1033System Owner/User Discovery
- T1036.005Match Legitimate Resource Name or Location
- T1036.008Masquerade File Type
- T1046Network Service Discovery
- T1047Windows Management Instrumentation
- T1049System Network Connections Discovery
- T1056.001Keylogging
- T1057Process Discovery
- T1059.001PowerShell
- T1059.003Windows Command Shell
- T1059.004Unix Shell
- T1068Exploitation for Privilege Escalation
- T1069Permission Groups Discovery
- T1069.001Local Groups
- T1069.002Domain Groups
- T1070.004File Deletion
- T1070.007Clear Network Connection History and Configurations
- T1074Data Staged
- T1074.001Local Data Staging
- T1078Valid Accounts
- T1078.002Domain Accounts
- T1083File and Directory Discovery
- T1087.001Local Account
- T1087.002Domain Account
- T1090Proxy
- T1090.001Internal Proxy
- T1090.003Multi-hop Proxy
- T1105Ingress Tool Transfer
Malware and tools used
Security timeline
- Activity reported by Cyber Security NewsVolt Typhoon used covert Silent Train relay network to exploit zero-days in management platforms, Lumen reports
- Zero-day reported by The Hacker NewsVolt Typhoon's Silent Train network tied to Cisco SD-WAN zero-day exploitation
Recent news
Volt Typhoon used covert Silent Train relay network to exploit zero-days in management platforms, Lumen reports
Lumen's Black Lotus Labs reports that Volt Typhoon used an operational framework called Silent Train, first seen in November 2023, to chain compromised routers, devices and enterprise servers as covert relays. The framework supported four confirmed and one likely zero-day campaign against management platforms including N-central, Versa Director, Cisco Catalyst SD-WAN, VeloCloud Orchestrator and Quest KACE. Victims included telecommunications, satellite communications, defence-linked universities and essential service operators, with Hawaii, California and Texas repeatedly targeted. Lumen assesses the activity as positioning for possible Indo-Pacific crises rather than evidence of disruption.
Volt Typhoon's Silent Train network tied to Cisco SD-WAN zero-day exploitation
Lumen's Black Lotus Labs attributes a covert access network called Silent Train to the China-nexus group Volt Typhoon. It was first identified in late 2023 and was used for zero-day exploitation and strategic access, using rotating chains of compromised SOHO, IoT and enterprise devices. Cisco Talos linked malware that steals keys from Cisco SD-WAN to infrastructure overlapping with this network, which has since been disrupted.