Volt Typhoon Targets US Critical Infrastructure via Silent Train

Up to six different virtual networks and compromised devices, including routers, have been used by Chinese government hackers to create winding pathways into critical U.S. networks. Researchers at Lumen’s Black Lotus Labs have identified this reproducible network pattern, which they have named “Silent Train.” The hackers have spent several years using novel tactics to burrow into networks while remaining hidden.

The activity is attributed to Volt Typhoon, a hacking group that U.S. national security officials state is focused on gaining secret access to key strategic targets. According to Michael Horka, a principal information security analyst at Black Lotus Labs, these targets include the defense and government sectors, telecommunications, and critical infrastructure such as aviation, rail, and water. Horka has spent years monitoring internet backbone traffic for his role at Lumen, a telecommunications firm that routes network traffic to track and disrupt criminal and nation state actors.

The Silent Train Method

The “Silent Train” tactic involves the creation of a roadmap to access networks where hackers never retrace their steps. To remain undetected, the group utilized previously undiscovered vulnerabilities and worked to cover their digital footprints. Horka described the process of uncovering the pattern as “a lot of thread pulling” that eventually led to a signature they could track. He noted that the group was “purposely trying to stay extremely quiet,” and admitted that the investigation often felt like “a wild goose chase.”

Hackers Target Infrastructure to Hinder Military Responses

Officials indicate that targeting these specific sectors allows for intelligence gathering and creates the potential for physical damage. Such actions could include cutting off access to ports or shutting off power to prevent a quick U.S. military response during a conflict or to create societal panic.

Horka stated that the hackers are highly motivated and invested in these operations, suggesting that network defenders must adopt a similar mindset. He urged threat hunters to “put on that black hat for a moment” and consider if their organization would be a valuable target. He noted that exposing the tradecraft of Volt Typhoon is intended to make it more difficult for the group to remain hidden, comparing the disclosure to “dropping a rock” into still pond water to see what happens.