Black Lotus Labs uncovers Volt Typhoon's ephemeral Silent Train network

Lumen Technologies' Black Lotus Labs detailed Silent Train, a covert access operation in which China-linked Volt Typhoon rapidly assembles and dismantles chains of compromised SOHO routers, IoT devices and enterprise infrastructure to burrow into hundreds of sensitive systems. The group can rebuild a new chain in under two minutes, with sessions averaging about four hours.

• Infrastructure chains are rebuilt in under 2 minutes
• Average session lasts roughly 4 hours
• Over 27 device classes abused, including Fortinet, Cisco and Ivanti
• Hundreds of victims notified: telecom, government, defense contractors, universities