Xitoy bilan bog'liq kiberjosuslik guruhi Volt Typhoon endi to'xtatilgan Silent Train deb nomlangan yashirin kirish tarmog'iga bog'langan, u nol kunlik zaifliklardan foydalanish va strategik kirish uchun ishlatilgan.
"2023-yil oxirida birinchi marta aniqlangan Silent Train buzilgan SOHO, IoT va korporativ infratuzilmaning aylanuvchi zanjirlaridan foydalanadi," deb aytdi Lumen Technologies Black Lotus Labs The Hacker News bilan bo'lishilgan hisobotda. "U anti-forenzik usullar, bo'limlarga ajratilgan operatsiyalar va operatsiyadan keyingi tozalashni qo'llaydi, bu esa aniqlash va atributsiyani minimallashtiradi."
Uning asosiy maqsadi zaiflikdan foydalanish, hisob ma'lumotlariga kirish, ma'lumotlarni o'g'irlash va jabrlanuvchi muhitlarga doimiy kirishni saqlab qolish kabi muhim hujum bosqichlarini osonlashtirishdir. Faoliyat ikki asosiy sabab bilan ajralib turadi -
- U pastki mijozlarga kengaytiriladigan kirish, sezgir tarmoqlar yoki strategik dasturlarni ta'minlay oladigan subyektlarni tanladi.
- U korporativ muhitlarda muhim rol o'ynaydigan oxirgi nuqta boshqaruv platformalari, tarmoq boshqaruv tizimlari, SD-WAN orkestratorlari va boshqaruv tekisligi texnologiyalarini nishonga oldi.
Telekommunikatsiya provayderlari, hukumat, mudofaa pudratchilari, sun'iy yo'ldosh va missiya-muhim aloqa xizmatlari, universitetlar, IT firmalari va suv, energiya, transport, dengiz, temir yo'l, aviatsiya va favqulodda xizmatlar kabi muhim infratuzilma bo'yicha yuzlab jabrlanuvchilar aniqlangan.
Volt Typhoon (aka Bronze Silhouette, Insidious Taurus, UNC3236, Vanguard Panda va Voltzite) Xitoy bilan bog'liq davlat homiyligidagi guruhga berilgan nom bo'lib, u muhim infratuzilma tarmoqlarini, ayniqsa aloqa, energiya, transport va suv hamda oqava tizimlari sektorlarini nishonga olishi bilan tanilgan.
Kamida 2021-yildan beri faol bo'lgan tahdid aktori avval Versa Director'dagi fayl yuklash zaifligidan nol kunlik sifatida foydalanib (CVE-2024-39717), VersaMem deb nomlangan maxsus veb qobiqni yetkazib berib, hisob ma'lumotlarini yig'ish va pastki mijozlarga kirishni ta'minlash uchun ishlatilgan.
Black Lotus Labs'dan olingan so'nggi topilmalar shuni ko'rsatadiki, bu xavfsizlik zaifligi Silent Train orqali tahdid aktori o'tkazgan to'rtta tasdiqlangan nol kunlik kampaniyadan biri edi. Qolgan uchta zaiflik quyida keltirilgan -
- CVE-2025-8875 va CVE-2025-8876 - N-able N-central'dagi ishonchsiz deserializatsiya va buyruq in'ektsiya zaifliklari to'plami.
- CVE-2026-20127 - Cisco Catalyst SD-WAN Controller'dagi autentifikatsiyani chetlab o'tish zaifligi
- CVE-2026-16812 - Arista VeloCloud Orchestrator'dagi operatsion tizim buyruq in'ektsiya zaifligi
Alohida, Volt Typhoon 2025-yil oktyabrida tuzatilishidan oldin Quest KACE'dagi ehtimoliy nol kunlik zaiflikdan foydalanishda ham gumon qilinmoqda. Kampaniya 30 dan ortiq jabrlanuvchiga ta'sir qilgan deb baholanmoqda.
"Silent Train tez aylanuvchi buzilgan SOHO, IoT va korporativ qurilmalar zanjirlaridan qurilgan bo'lib, ular talabga binoan ekspluatatsiya qilinadi, ehtiyotkorlik bilan tanlangan nishonlarga qarshi ishlatiladi, har bir operatsiyadan keyin tozalanadi va doimiy ravishda yangilanadi," deb aytdi Black Lotus Labs.
"Bu model Volt Typhoon'ga ekspluatatsiya va ekspluatatsiyadan keyingi operatsiyalarni ajoyib operatsion xavfsizlik bilan o'tkazish, aniqlash, atributsiya va to'xtatish imkoniyatlarini minimallashtirish imkonini berdi."
Bu hujumlarning o'ziga xos xususiyati AQShning strategik ahamiyatga ega yirik korporativ muhitlarida keng ko'rinish, nazorat va kirish eshiklarini ochadigan tizimlarni qayta-qayta nishonga olishdir.
Qiziqarlisi shundaki, yashirin kirish qobiliyati 2023-yil noyabr atrofida shakllana boshlagan, bu esa birinchi marta KV-botnet, bir nechta Xitoy bilan bog'liq davlat homiyligidagi tahdid aktorlari, jumladan Volt Typhoon bilan bog'liq IoT botnetini to'xtatishdan bir necha hafta oldin sodir bo'lgan.
Silent Train'ning operatsion faolligi botnetning 2024-yil yanvar oxirida ikkinchi marta to'xtatilishidan so'ng keskin oshgan, shu bilan birga turli qurilma turlari va geografiyalar bo'yicha efemer infratuzilmaga o'tgan.
"Doimiy infratuzilmani ishlatish o'rniga, Volt Typhoon kerak bo'lganda qayta qurishi mumkin bo'lgan bir martalik buzilgan qurilmalar zanjirlaridan foydalanadigan modelga o'tdi," deb aytdi Black Lotus Labs. "Volt Typhoon tezda vaqtinchalik infratuzilmani yig'di va buzdi, bu esa qimmatli kirishni himoya qiladigan chidamli, xavfsiz va bo'limlarga ajratilgan ramka yaratdi."
"Ko'p qatlamli, ko'p sakrashli ramka" deb ta'riflangan Silent Train Volt Typhoon operatorlariga zararli trafikni bir nechta qurilma orqali o'tkazib, nishonga yetguncha uning manbasini jabrlanuvchilar va himoyachilardan yashirish imkonini beradi. Zanjirdagi har bir bog'lanish o'ziga xos maqsadga xizmat qiladi -
- Vaqtinchalik sahnalash maydoni sifatida ishlaydigan va tahdid aktorlariga har bir sessiyadan keyin ularni ta'minlash va tashlab yuborish imkonini beradigan virtual xususiy serverlar (VPS). Sessiyalar AQSh tashqarisidagi VPS infratuzilmasidan boshlanadi.
- Turli mamlakatlar, provayderlar va apparat bo'yicha joylashgan AQShdan tashqari buzilgan SOHO va IoT qurilmalari, ular hujumning boshlang'ich nuqtasini yashiradi.
- Ichki jabrlanuvchiga yetishdan oldin chiqish tuguni sifatida ishlaydigan AQShda joylashgan buzilgan qurilmalar, ular geofens va IP obro' ro'yxatlarini chetlab o'tishga yordam beradi.
SOHO va IoT qurilmalaridan (masalan, TP-Link, Intelbras, Ruckus Wireless, SATO, NETGEAR, Zyxel va Cambium) korporativ platformalargacha (masalan, Fortinet, Cisco, PRTG, Mirth Connect va CyberPanel) 27 dan kam bo'lmagan qurilma sinfi ekspluatatsiya qilingan va yashirin tarmoqqa kiritilgan.
"Silent Train operatsion intizom bilan ajralib turadi, doimiy relaylar yoki C2 infratuzilmasi o'rniga qisqa muddatli, o'z-o'zini boshqaradigan sessiyalarga e'tibor qaratadi," deb aytdi Black Lotus Labs. "Bu sessiyalarni qurish uchun uning operatorlari SOHO, IoT va boshqa relay qurilmalaridagi ochiq veb interfeyslarni ekspluatatsiya qiladi, so'ngra buzilgan tugun orqali zanjirli SSH kirishini ta'minlash uchun faqat kerakli vositalarni joylashtiradi."
"Bu vaqtinchalik SSH xizmatlari, kalitlar, konfiguratsiya fayllari va 'yashash' yordamchi dasturlarini o'z ichiga olgan. Operatsion sessiyalar oxirida ular har bir artefaktni olib tashladi va o'z izlarida operatsion zanjirni buzdi. Silent Train sessiyalari o'rtacha to'rt soat davom etgan, ba'zilari esa faqat bir necha daqiqa davom etgan."
Yana bir e'tiborga molik jihat - Silent Train ichida ma'lum qurilma turlarining ma'lum pozitsiyalarga tayinlanishi. Masalan, Intelbras modemlari faqat relay tugunlari sifatida topilgan, Netgear Orbi va Fortinet FortiGate apparatlari esa AQShda joylashgan oraliq va chiqish nuqtalari sifatida xizmat qilgan, ular jabrlanuvchi bilan o'zaro aloqada bo'lish uchun javobgar.
Boshqacha aytganda, infratuzilma qatlamlar bo'yicha ataylab bo'limlarga ajratishni ko'rsatadi, ba'zi qurilma turlarini doimiy ravishda ma'lum rollarga cheklab, infratuzilmaning o'zi esa vaqt o'tishi bilan o'zgarib, atributsiya harakatlarini murakkablashtiradi.
Biroq, 2025-yil boshiga kelib, Silent Train to'liq efemer relay tarmog'idan gibrid arxitekturaga o'tgan deb ishoniladi, u korporativ darajadagi qurilmalarni har bir aloqadan keyin o'zgartirish o'rniga o'rtacha bir oydan uch oygacha saqlab qolgan.
Platformaning keyingi yetuklashuvi Chisel va FRP kabi ochiq manbali proksi-lardan foydalanib, buzilgan qurilmalardan yuqori infratuzilmaga trafik yuboradigan teskari tunnel variantlarini joriy etgan.
AQSh ichida Gavayi, Kaliforniya va Texas Silent Train operatsiyalarining asosiy hududlari sifatida paydo bo'lgan, bu esa ushbu shtatlarda yirik harbiy inshootlar, telekommunikatsiya infratuzilmasi, mudofaa pudratchilari, sun'iy yo'ldosh aloqa provayderlari va muhim logistika tarmoqlari joylashganligi bilan bog'liq.
"Jabrlanuvchi tanlovi mudofaa, logistika, aloqa, harbiy va fuqarolik operatsiyalarini qo'llab-quvvatlaydigan muhim ekotizimlarga kirishni saqlab qolish uchun ataylab qilingan harakatlarni ko'rsatadi, ayniqsa Hind-Tinch okeani mintaqasida keskinlik yoki inqiroz davrida," deb aytdi Black Lotus Labs.
"Natijada yuqori darajada tuzilgan, strategik kirishni keng miqyosda olish, himoya qilish va saqlab qolish uchun qurilgan ramka tasviri paydo bo'ladi. Markazlashtirilgan boshqaruv platformalari va boshqaruv tekisligi texnologiyalarini qayta-qayta nishonga olish orqali Silent Train Volt Typhoon AQShning eng muhim tarmoqlariga kirishni tizimli ravishda izlab topishi va saqlab qolishini ko'rsatadi."
The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been put to use for zero-day exploitation and strategic access.
"First identified in late 2023, Silent Train uses rotating chains of compromised SOHO, IoT, and enterprise infrastructure," Lumen Technologies Black Lotus Labs said in a report shared with The Hacker News. "It employs anti-forensic techniques, compartmentalized operations, and post-operation cleanup to minimize detection and attribution."
Its main purpose is to facilitate critical attack phases like vulnerability exploitation, credential access, data exfiltration, and to maintain continued access to victim environments. The activity stands out for two main reasons -
- It singled out entities that could provide scalable access to downstream customers, sensitive networks, or strategic programs.
- It targeted endpoint management platforms, network management systems, SD-WAN orchestrators, and control plane technologies that play a crucial role within enterprise environments.
Hundreds of victims have been identified across telecommunications providers, government, defense contractors, satellite and mission-critical communication services, universities, IT firms, and critical infrastructure such as water, energy, transportation, maritime, rail, aviation, and emergency services.
Volt Typhoon (aka Bronze Silhouette, Insidious Taurus, UNC3236, Vanguard Panda, and Voltzite) is the moniker assigned to a China-linked state-sponsored group known for its targeting of critical infrastructure networks, particularly communications, energy, transportation, and water and wastewater systems sectors.
Known to be active since at least 2021, the threat actor was previously observed exploiting a file upload vulnerability in Versa Director as a zero-day (CVE-2024-39717) to deliver a bespoke web shell called VersaMem designed to harvest credentials and enable access to downstream customers.
The latest findings from Black Lotus Labs show that the security flaw was one among four confirmed zero-day campaigns the threat actor has conducted through Silent Train. The remaining three vulnerabilities are listed below -
- CVE-2025-8875 and CVE-2025-8876 - A set of insecure deserialization and command injection vulnerabilities in N-able N-central.
- CVE-2026-20127 - An authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller
- CVE-2026-16812 - An operating system command injection vulnerability in Arista VeloCloud Orchestrator
Separately, Volt Typhoon is also suspected to have taken advantage of a likely zero-day vulnerability in Quest KACE before it was patched in October 2025. The campaign is estimated to have impacted more than 30 victims.
"Silent Train is built around rapidly rotating chains of compromised SOHO, IoT, and enterprise devices that are exploited on demand, used against carefully selected targets, cleaned up after each operation, and continuously refreshed," Black Lotus Labs said.
"This model has enabled Volt Typhoon to conduct exploitation and post-exploitation operations with exceptional operational security while minimizing opportunities for detection, attribution, and disruption."
A defining characteristic of these attacks is the repeated targeting of systems that can open the door to broad visibility, control, and access across large enterprise environments of strategic value to the U.S.
What's interesting is that the covert access capability began to take shape sometime around November 2023, just weeks before the first round of disruption targeting KV-botnet, an IoT botnet linked to multiple China-nexus state-sponsored threat actors, including Volt Typhoon.
Silent Train's operational activity is said to have surged in the wake of the botnet's second disruption in late January 2024, while simultaneously shifting to an ephemeral infrastructure comprising diverse device types and across geographies.
"Rather than continue using persistent infrastructure, Volt Typhoon shifted to a model using one-time-use chains of compromised devices that it could rebuild as needed," Black Lotus Labs said. "Volt Typhoon rapidly assembled and dismantled transient infrastructure, creating a resilient, secure, and compartmentalized framework that protected valuable access."
Described as a "layered, multi-hop framework," Silent Train is designed to let Volt Typhoon operators relay malicious traffic through several devices before it reaches the targets so as to obscure its origins from both victims and defenders. Each link in the chain serves a specific purpose -
- Virtual private servers (VPS) that function as a temporary staging area and allow threat actors to provision and discard them after each session. The sessions begin from VPS infrastructure located outside the U.S.
- Compromised non-U.S. SOHO and IoT devices located across different countries, providers, and hardware that conceal the starting point of the attack.
- U.S.-based compromised devices that function as an exit node before reaching the domestic victim and help evade geofencing and IP reputation blocklists.
No less than 27 device classes, ranging from SOHO and IoT devices (e.g., TP-Link, Intelbras, Ruckus Wireless, SATO, NETGEAR, Zyxel, and Cambium) to enterprise platforms (e.g., Fortinet, Cisco, PRTG, Mirth Connect, and CyberPanel), have been exploited and enrolled into the covert network.
"Silent Train stands out for its operational discipline, focusing on short-lived, selfmanaged sessions rather than persistent relays or C2 infrastructure," Black Lotus Labs said. "To construct these sessions, its operators exploit exposed web interfaces on SOHO, IoT, and other relay devices, then deploy only the tooling needed to enable chained SSH access through the compromised node."
"This included temporary SSH services, keys, configuration files, and 'live off the land' utilities. At the end of operational sessions, they removed every artifact and dismantled the operational chain in their wake. Silent Train sessions lasted about four hours on average, with some lasting only minutes."
Another notable aspect is the designation of certain device types to specific positions within Silent Train. For instance, Intelbras modems have been found to only appear as relay nodes, while Netgear Orbi and Fortinet FortiGate appliances served as U.S.-based intermediary and exit points responsible for interacting with the victim.
Put differently, the infrastructure points to deliberate compartmentalization across layers, confining some device types to certain roles that remain constant while the underlying infrastructure itself changes over time so as to complicate attribution efforts.
By early 2025, however, Silent Train is believed to have evolved from a completely ephemeral relay network to a hybrid architecture that retained enterprise-grade devices for an average of one to three months instead of changing them after each engagement.
Subsequent maturation of the platform introduced reverse-tunnel variants that used open-source proxies like Chisel and FRP to send traffic from infected devices to upstream infrastructure.
Within the U.S., Hawaii, California, and Texas have emerged as the focus areas of Silent Train operations, which boils down to the fact that these states host major military installations, telecommunications infrastructure, defense contractors, satellite communications providers, and critical logistics networks.
"Victimology indicates deliberate efforts to maintain access to critical ecosystems that support defense, logistics, communications, military and civilian operations, especially during heightened tensions or crises in the Indo-Pacific region," Black Lotus Labs said.
"The resulting picture is one of a highly structured framework built to acquire, protect, and sustain strategic access at scale. Through repeated targeting of centralized management platforms and control plane technologies, Silent Train shows how Volt Typhoon systematically pursues and preserves access to some of the most consequential networks in the United States."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.