Silent Train: Volt Typhoon’s Sophisticated Infection Chain into US Targets Exposed

For several years, researchers and government officials have described the Volt Typhoon intrusions into US critical infrastructure in superlative terms.

The state hacking group from China, which has methodically and strategically breached US critical infrastructure since at least 2023 — some say in preparation for attacks against these systems should China invade Taiwan — has been called extremely stealthy and ultra-sophisticated. Former FBI Director Christopher Wray referred to them, along with other Chinese state-sponsored hacking groups, as the “defining threat of our generation.”

Yet researchers and government officials have provided little evidence to support the hyperbolic descriptions of this group and its activity.

Today, security researchers are finally revealing some of the sophisticated tactics Volt Typhoon attackers have been using for years to gain access to high-profile targets to steal credentials, siphon data and establish persistence inside these networks. The targets include an array of victims across numerous sectors in the US, but the nature of the victims and their concentration in specific geographical regions supports theories that Volt Typhoon has chosen them for strategic military reasons.

Researchers at Lumen Technologies’ Black Lotus Labs — which has played a critical role in tracking the group since its discovery three years ago — have released a report on Silent Train, a covert and constantly evolving network, or daisy chain, of procured and compromised devices (including SOHO routers and internet-of-things devices) that Volt Typhoon uses to rapidly slip into and out of the high-profile networks they’re actually targeting. The hackers often remain inside a target network for just a few hours or minutes, then erase all tracks of their activity before the victims realize they’ve been breached.

Each daisy chain of procured and compromised devices, located outside and inside the US, is used just once to gain entry to a single target, then discarded and replaced by a new chain of other procuired and compromised devices to attack other targets or even to attack that same target at a later date.

These tactics have made it difficult for victims and threat intelligence researchers to detect them while they’re still in a network or trace their path to the targeted network once all artifacts have been erased.

These stealth methods demonstrate extreme patience and discipline, says Mike Horka, principal information security engineer at Black Lotus Labs, who gave a nonpublic talk about Silent Train recently at SentinelOne's Labscon security conference in Arizona and authored the public report released today.

“This is not something that we have seen before on this scale and not with this level of operational security,” says Horka. “There’s an operational structure with Silent Train… which is very, very rare.”

The researchers have notified hundreds of victims over the three years they have tracked the Silent Train infections of Volt Typhoon. The targets include US government agencies and defense contractors, telecoms, emergency communication providers, and entities involved in sensitive law enforcement and military communications, geospatial intelligence gathering, and the operation of low earth orbit satellites. They have also included universities engaged in military research or that have ROTC programs and other military relationships.

But in addition to these, Volt Typhoon has targeted managed service providers and IT providers — presumably for the privileged access they have into customer devices and networks — as well as critical infrastructure operators in the energy, water, rail, and shipping sectors, all of which provide essential services not only to civilians but also to the government and military.

Horka says the targets are diverse in nature but share a common characteristic: they are all organizations that occupy positions of trust and influence or that provide connectivity and access to important customers, sensitive networks, or strategic programs that are particularly important to the military.

Government officials have characterized Volt Typhoon’s activity as “pre-positioning” for a possible conflict with Taiwan, and based on the sophistication of the intrusions and the geographical location where many of the targeted victims are concentrated, the Black Lotus Labs researchers agree.

“Across multiple years of activity, Hawaii, California, and Texas repeatedly emerged as focal points for Silent Train operations,” they write in their report.

Major military installations, telecommunications infrastructure, defense contractors, satellite communications providers, and critical logistics networks are based in these states and “support strategically significant US operations, particularly within the Indo-Pacific region,” the researchers note. The victims occupy “positions of trust and connectivity upon which military, government, and civilian operations depend” and “would be of heightened importance during geopolitical tensions or crises.”

But Horka says the breaches aren’t just about pre-positioning.

“We have seen them exfiltrating documents related to military operations and structures of networks and getting credentials that can get them long-term access. I don’t think they are just trying to preposition or espionage; I think it’s a combination of the two.”

Sophisticated Daisy Chains

The researchers first uncovered Silent Train activity in 2023 while analyzing a separate covert network and uncovering unusual SSH relay chains. Covert networks are networks of servers or devices that attackers use to obfuscate their activity and thwart attribution. Generally, attackers will use a covert network repeatedly, but in the case of Volt Typhoon, the researchers found that the actors were using one-time infection chains that required a lot of work to set up, only to dismantle them after each session.

Over three years of tracking the group, they established that the hackers follow a distinct pattern in setting up their Silent Train infection chains. They begin with the attackers first renting or procuring a virtual private server (VPS) hosted somewhere outside the US by Alibaba Cloud, Huawei Cloud or UCloud. They then procure another VPS but in a different geographical region outside the US to begin laying the tracks of their infection train. Once they have done this, they may compromise a so-called SOHO (small office/home office) router or internet-of-things device outside the US before pivoting to a router or IoT device inside the US, or they may pivot immediately into the US to compromise such a device on the way to their actual target.

The attackers work rapidly, often assembling a Silent Train infection chain in less than two minutes — suggesting that parts of their activity is automated. The types of devices they compromise in the early hops of their infection chain outside of the US are never the same types or models of devices they compromise for later hops inside the US, and vice versa.

Horka says this is likely done to thwart the visibility of defenders and investigators. The maker of a device might have visibility for all of their devices used globally, but if the attackers only compromise those specific devices in Europe and not in the US, the maker won’t see beyond those European infections as the attackers move to other device types in the US. This makes it difficult for anyone to see the entire infection chain at a glance.

The VPSes are used as a temporary staging area, and the other infection hops outside the US are used to add geographic and device diversity to obscure the origin of the hackers and confuse anyone trying to track them. The devices compromised inside the US, before the attackers hit their end targets, are designed to help the malicious traffic blend into normal internet traffic and avoid firewall protections that block traffic coming from specific geographic locations or IP addresses. 

“Together, these layers compartmentalized operations, hindered attribution, and made it difficult to trace activity back through the entire chain,” the researchers write.

The attackers don’t always stick with the same types of devices to compromise; instead, they introduce a new device type into their infection chains about once a month. The intrusion chains the researchers tracked involved more than 27 different classes of devices, including TP-Link and Netgear routers used in small offices and home offices. They also, however, compromised enterprise platforms — including Fortinet, Cisco, PRTG, Mirth Connect, and CyberPanel — which are often used at the end of their infection chain in the US, before they breach their end targets.

“Unlike the ephemeral SOHO and IoT infrastructure used only for specific operations, these enterprise-grade devices remained compromised and available in Silent Train for an average of one to three months,” the researchers note. “Instead of supporting a single engagement, they reused [these] same hops across several intrusion operations before replacing them.”

Device types are strictly used for specific roles in the infection chains.  For example, the hackers only infected Intelbras modems if they were located outside the US and only infected Netgear Orbi devices if they were located inside the US.

When they finally reach their targets, the attackers often compromise management systems that administrators use to centrally manage their networks.

“These systems provide administrative access to many devices, detailed asset inventories, network visibility, and remote management, and they act as centralized trust points for enterprises and downstream customer environments,” the researchers note.

Many of the devices they have targeted have known vulnerabilities for which patches are available. But the researchers found at least four zero-day vulnerabilities used in Silent Train breaches. 

The attackers rarely deposit malware onto infected systems, instead hijacking existing tools on a device or network in a manner called “living off the land” to avoid detection by scanners looking for malicious tools.

And once they complete their intrusion inside a targeted network, they rapidly erase all traces of their activity inside that network — including erasing or altering logs. They do the same across the entire infection chain that they used to get into that network, restoring each compromised device to its former state.

“At the end of operational sessions, they removed every artifact and dismantled the operational chain in their wake,” leaving “no evidence for defenders to uncover,” the researchers note in their report.

When Volt Typhoon’s activity was first publicly disclosed three years ago, owners and operators of critical infrastructure expressed frustration that they weren’t given any technical details to help them detect the intruders in their networks. But as the new research shows, there is often little left behind after a breach to help investigators find the attackers in networks.

When the attackers return to a targeted network, they often get back in by using legitimate employee credentials that they stole during their initial session inside that network, as well as a different chain of procured and compromised systems to reach the target.

“They might return in 30 days for a two-hour session and a month later for six hours,” says Horka. But each time they return, they “use a different set of hops” to get in.

One of their primary goals, the researchers say, is to obtain and preserve access across a wide swath of systems and organizations in a manner that gives them broad visibility, reach and control across a large ecosystem. And Silent Train, the researchers say, is the framework they have built to acquire and sustain that strategic access at scale.

“Through repeated targeting of centralized management platforms and control plane technologies, Silent Train shows how Volt Typhoon systematically pursues and preserves access to some of the most consequential networks in the United States,” they conclude.

See also this interview that Mike Horka did with Ryan Naraine on his Security Conversations podcast, as well as the full report from Lumen Technologies' Black Lotus Labs.

Update 10.30.26: To clarify that the actors rented or purchased the VPSes instead of compromising them, as opposed to the other devices in their infection chain, which they compromised.