Black Lotus Labs
CompanyThreat actors named alongside
Source: RedTeamDaily stories that mention bothSecurity timeline
- Activity reported by Cyber Security NewsVolt Typhoon used covert Silent Train relay network to exploit zero-days in management platforms, Lumen reports
- Zero-day reported by The Hacker NewsVolt Typhoon's Silent Train network tied to Cisco SD-WAN zero-day exploitation
Recent news
Volt Typhoon used covert Silent Train relay network to exploit zero-days in management platforms, Lumen reports
Lumen's Black Lotus Labs reports that Volt Typhoon used an operational framework called Silent Train, first seen in November 2023, to chain compromised routers, devices and enterprise servers as covert relays. The framework supported four confirmed and one likely zero-day campaign against management platforms including N-central, Versa Director, Cisco Catalyst SD-WAN, VeloCloud Orchestrator and Quest KACE. Victims included telecommunications, satellite communications, defence-linked universities and essential service operators, with Hawaii, California and Texas repeatedly targeted. Lumen assesses the activity as positioning for possible Indo-Pacific crises rather than evidence of disruption.
Volt Typhoon's Silent Train network tied to Cisco SD-WAN zero-day exploitation
Lumen's Black Lotus Labs attributes a covert access network called Silent Train to the China-nexus group Volt Typhoon. It was first identified in late 2023 and was used for zero-day exploitation and strategic access, using rotating chains of compromised SOHO, IoT and enterprise devices. Cisco Talos linked malware that steals keys from Cisco SD-WAN to infrastructure overlapping with this network, which has since been disrupted.