Lumen details Volt Typhoon’s Silent Train framework exploiting zero-days to target US critical infrastructure sites

Silent Train is a layered, multi-hop framework that lets Volt Typhoon operators route activity through several devices before reaching their targets.

Volt Typhoon assigned specific device types to fixed positions within Silent Train chains and never deviated from those roles over the three-year observation period.

“As Silent Train matured, reverse-tunnel variants were introduced alongside the traditional SSH-chaining model,” the researchers noted.

Silent Train differed fundamentally from the infrastructure Volt Typhoon used for target development and early reconnaissance, which ran over additional operational relay box (ORB) networks and ad-hoc infrastructure.

Together with the selective targets and disposable chains, this indicates Volt Typhoon kept Silent Train for carefully chosen missions, as the zero-day campaigns demonstrated.