The state-sponsored threat actor known as Volt Typhoon has transitioned to a new, highly automated operational framework dubbed “Silent Train” to conduct zero-day attacks against critical infrastructure. According to research from Lumen Technologies’ Black Lotus Labs published on October 28, 2024, the framework is designed to bypass traditional botnet defenses by utilizing ephemeral, rapidly rotating relay chains.
Silent Train represents a significant evolution from the group’s previous “KV Botnet,” which was disrupted by the FBI in early 2024. While the KV Botnet relied on more persistent infections of SOHO routers and IoT devices, Silent Train is built around “session-based” architecture. These sessions typically last only four hours, during which the attackers deploy tools, execute their objective, and then wipe all malicious artifacts from the relay nodes to prevent forensic reconstruction.
Targeting Control Plane Infrastructure
The framework has been linked to the exploitation of at least four zero-day vulnerabilities. Among the most prominent is CVE-2024-39717, a critical file upload vulnerability in Versa Director. Researchers noted that the group specifically targets “control plane” infrastructure, which includes SD-WAN orchestrators, endpoint management systems, and other centralized administrative platforms that provide broad access to client networks.
Beyond Versa Director, the framework has been utilized to target infrastructure from N-able and VeloCloud. This focus on management software allows the threat actor to move laterally into the internal networks of downstream organizations while maintaining a minimal footprint on the initial point of entry.
Advanced Relay Tactics and Geographic Focus
To mask the origin of their traffic, Volt Typhoon uses Operational Relay Box (ORB) networks. These networks consist of compromised devices arranged in chains of four to six hops. The complexity of these chains, combined with the two-minute setup time for new sessions, makes it nearly impossible for network administrators to track the activity using standard NetFlow analysis or traditional logging.
Analysis of the targeting patterns reveals a geographical concentration in Hawaii, California, and Texas. This distribution suggests a strategic focus on locations critical to U.S. military logistics and Indo-Pacific operations. By maintaining a presence on these specific regional networks, the actor is positioned to disrupt or monitor communications in the event of a geopolitical conflict.
Defenders are advised to monitor for unusual outbound traffic from management servers and to prioritize the patching of internet-facing control plane software. Because Silent Train wipes its tools after each session, detection relies heavily on identifying the initial exploitation of vulnerabilities rather than finding persistent malware on the relay nodes themselves.
