Volt Typhoon targeted enterprise control planes via ever-changing "Silent Train" relay network

How Silent Train works Volt Typhoon began building the Silent Train network before the December 2023 takedown of the KV botnet, and ramped up its use in its aftermath.

While Volt Typhoon uses other infrastructure for reconnaissance, Silent Train was reserved for “exploitation, credential access, data exfiltration and ongoing engagement with victim environments,” researchers found.

“In some cases, as many as six hops separated the operator from the victim,” Black Lotus Labs noted.

Example of a Silent Train session (Source: Black Lotus Labs) “As Silent Train matured, reverse-tunnel variants were introduced alongside the traditional SSH-chaining model.

Victimology Over the past three years, Black Lotus Labs’ monitoring of Silent Train has led to hundreds of victim notifications.