Xitoy davlat homiyligidagi xakerlar guruhi Volt Typhoon tanlangan nishonlarga qarshi hujumlar, jumladan yuqori qiymatli tizimlarga qarshi nol kunlik hujumlar uchun talab bo'yicha buzilgan va bir-biriga ulangan qurilmalar aylanuvchi zanjirlariga tayanadigan tizimdan foydalanib kelmoqda.
Ushbu tizim Silent Train deb nomlangan, chunki tahdid aktori uni tanlangan nishonlarga qarshi ishlatadi, har bir operatsiyadan so'ng uni tozalaydi va doimiy ravishda yangilaydi.
Aloqa kompaniyasi Lumenning tahdid tadqiqot bo'limi Black Lotus Labs tadqiqotchilari Silent Trainni uch yil davomida kuzatib kelishgan va Volt Typhoonning chekka va boshqaruv infratuzilmasiga hujumlarda kamida to'rtta nol kunlik zaiflikdan foydalanganini tasdiqlashgan.
Nishonlar orasida telekommunikatsiya firmalari, davlat idoralari, mudofaa pudratchilari, ta'lim muassasalari, kommunal xizmatlar/muhim infratuzilma, sun'iy yo'ldosh xizmatlari provayderlari, IT firmalari, MSPlar, transport, aviatsiya va favqulodda xizmatlar bor.
Black Lotus Labs kuzatuvlari eng ko'p nishonga olingan hududlar Kaliforniya, Texas va Gavayi ekanligini ko'rsatadi, bu esa Hind-Tinch okeani masalalariga e'tibor qaratilayotganini anglatadi.
.jpg)
Jabrlanuvchilar xaritasi Manba: Black Lotus Labs
Volt Typhoon avval AQShning muhim infratuzilmasiga, jumladan aloqa, energetika, transport va suv tizimlariga hujum qilgan, CISA esa u kelajakdagi inqiroz yoki mojaro paytida potentsial buzilish uchun kirish o'rnatishga intilayotganini ogohlantirgan.
Tadqiqotchilarning aytishicha, Silent Trainning joylashtirilishi qisman FBI tomonidan KV-Botnetning buzilishi bilan bog'liq, bu botnet Volt Typhoon AQShdagi muhim infratuzilmaga hujum qilganda aniqlanishdan qochish uchun ishlatilgan.
Vaqt bo'yicha faoliyat taqqoslash Manba: Black Lotus Labs
Silent Train relay tarmog'i
Silent Train amalda Volt Typhoon hujumlarining kelib chiqishini yashirish uchun foydalanadigan buzilgan qurilmalardan tashkil topgan relay infratuzilmasidir.
Operatorlar o'z faoliyatini AQShdan tashqaridagi VPS infratuzilmasi orqali yo'naltiradi, so'ngra uni routerlar kabi oraliq relay vazifasini bajaradigan buzilgan qurilmalar orqali o'tkazib, hujumlarni boshlaydi.
Black Lotus Labs ma'lumotiga ko'ra, Intelbras modemlari xorijiy relaylar sifatida, Netgear Orbi qurilmalari esa AQSh ichidagi sakrash nuqtalari sifatida ishlatilgan.
Silent Train hujum umumiy ko'rinishi Manba: Black Lotus Labs
Tahdid aktorining Silent Train'dan foydalanishi zaifliklardan foydalanish, ma'lumotlarni o'g'irlash, ma'lumotlarni tashqariga chiqarish va buzilgan tizimlarda doimiy masofaviy kirishni saqlab qolishni o'z ichiga oladi.
Silent Train faoliyatini kuzatish orqali tadqiqotchilar quyidagi mahsulotlar uchun nol kunlik eksploitlarni kuzatishgan:
- CVE-2026-16812 – VeloCloudOrchestrator
- CVE-2026-20127 – Cisco Catalyst SD-WAN
- CVE-2025-8875 va CVE-2025-8876 – N-able N-central
- CVE-2024-39717 – Versa Director
- Quest KACE (gumon qilingan nol kunlik)
Ushbu platformalarni buzish tahdid aktorlariga keng ma'muriy nazorat beradi, bu esa aniqlanishni keltirib chiqarishi mumkin bo'lgan "shovqinli" yon harakatlarsiz ma'lumotlarni o'g'irlash, masofaviy kirish va quyi mijozlarga yetib borish imkonini beradi.
Ekspluatatsiya xronologiyasi Manba: Black Lotus Labs
"Ushbu sessiyalarni qurish uchun uning operatorlari SOHO, IoT va boshqa relay qurilmalaridagi ochiq veb-interfeyslarni ekspluatatsiya qiladi, so'ngra buzilgan tugun orqali zanjirli SSH kirishini ta'minlash uchun faqat kerakli vositalarni joylashtiradi," deb tushuntiradi Black Lotus Labs bugungi hisobotida.
"Bu vaqtinchalik SSH xizmatlari, kalitlar, konfiguratsiya fayllari va 'yashovchi' yordamchi dasturlarni o'z ichiga olgan."
Sessiya tugagandan so'ng, odatda 8 soatdan kamroq vaqt ichida, tahdid aktorlari bir martalik relaylardan barcha vositalar, kalitlar va konfiguratsiya fayllarini o'chirib tashlaydi.
2025-yil boshiga kelib, tadqiqotchilar tizimning gibrid bo'lib qolganini, bir martalik relaylar bilan birga bir oydan uch oygacha saqlanib qolgan buzilgan korporativ tizimlardan foydalanilayotganini payqashgan.
Black Lotus Labs Silent Train yuqori qiymatli nishonlar va Xitoy standart vaqti (CST) mintaqasida ehtiyotkorlik bilan, qo'lda bajariladigan operatsiyalar uchun ajratilgan deb hisoblaydi. Ushbu nishonlarga qarshi nol kunliklardan foydalanish bu taxminni yanada kuchaytiradi.
Tadqiqotchilar markazlashtirilgan boshqaruv tizimlari atrofidagi xavfsizlikni kuchaytirish, ma'muriy interfeyslarga internet kirishini cheklash, zaifliklarni tezda tuzatish va uzoqroq saqlash muddati bilan markazlashtirilgan jurnallarni yuritishni tavsiya qiladi.
Shuningdek, ular g'ayrioddiy ma'muriy faoliyatni kuzatish, mijoz yoki hamkor tarmoqlarini ochib qo'yishi mumkin bo'lgan ishonchli ulanishlarni ko'rib chiqish va Volt Typhoon bo'yicha CISA va NCSC yo'riqnomalariga amal qilishni maslahat berishadi.
Hujumchilar haqiqiy ma'lumotlarga ega bo'lgach, ularning harakatlarining faqat 37 foizi bloklanadi
Umumiy oldini olish ballari dastlabki kirishdan keyin sodir bo'ladigan narsalarni yashirishi mumkin. Hujumchilar haqiqiy ma'lumotlardan foydalanayotganda, oldini olish keskin pasayadi.
Blue Report 2026 mijoz ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha texnika-texnika himoyalarni o'lchaydi.
Hisobotni oling
Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems.
The framework has been dubbed Silent Train because the threat actor uses it against select targets, cleans it up after each operation, and refreshes it continuously.
Researchers at Black Lotus Labs, the threat research division of communications company Lumen, have been tracking Silent Train for three years and confirmed that Volt Typhoon exploited at least four zero-day vulnerabilities in attacks targeting edge and management infrastructure.
Targets include telecommunication firms, government agencies, defense contractors, educational institutes, utilities/critical infrastructure, satellite service providers, IT firms, MSPs, transportation, aviation, and emergency services.
Black Lotus Labs’ observations indicate the most targeted regions are California, Texas, and Hawaii, suggesting a focus on Indo-Pacific matters.
.jpg)
Victims map Source: Black Lotus Labs
Volt Typhoon previously targeted U.S. critical infrastructure, including communications, energy, transportation, and water systems, with CISA warning that it seeks to establish access for potential disruption during a future crisis or conflict.
According to the researchers, Silent Train's deployment was partly fueled by the FBI's disruption of KV-Botnet, a botnet that Volt Typhoon used to evade detection when attacking critical infrastructure in the US.
Activity comparison over time Source: Black Lotus Labs
Silent Train relay network
Silent Train is practically a relay infrastructure formed of compromised devices that Volt Typhoon uses to hide the origin of its attacks.
The operators route their activity through VPS infrastructure outside the United States, then pass it through hacked devices such as routers that act as intermediate relays before launching attacks.
Black Lotus Labs says Intelbras modems served as overseas relays, while Netgear Orbi devices acted as hops in the U.S.
Silent Train attack overview Source: Black Lotus Labs
The threat actor's use of Silent Train involves exploiting vulnerabilities, stealing credentials, exfiltrating data, and maintaining persistent remote access to compromised systems.
By monitoring Silent Train activity, the researchers were able to observe zero-day exploits for the following products:
- CVE-2026-16812– VeloCloudOrchestrator
- CVE-2026-20127 – Cisco Catalyst SD-WAN
- CVE-2025-8875 and CVE-2025-8876 – N-able N-central
- CVE-2024-39717 – Versa Director
- Quest KACE (suspected zero-day)
Compromising these platforms gives threat actors broad administrative control, enabling credential theft, remote access, and reach into downstream customers without the “noisy” lateral movement that might trigger detection.
Exploitation timeline Source: Black Lotus Labs
“To construct these sessions, its operators exploit exposed web interfaces on SOHO, IoT, and other relay devices, then deploy only the tooling needed to enable chained SSH access through the compromised node,” Black Lotus Labs explains in a report today.
“This included temporary SSH services, keys, configuration files, and “live off the land” utilities.”
After the session ends, typically in under 8 hours, the threat actors remove all their tooling, keys, and configuration files from the disposable relays.
By early 2025, researchers noticed that the framework become hybrid, using disposable relays alongside compromised enterprise systems thaat were retained between one and three months.
Black Lotus Labs believes Silent Train was reserved for high-value targets and careful, hands-on operations conducted on China Standard Time (CST) timezone. The use of zero-days against those targets further strengthens the assumption.
The researchers recommend strengthening security around centralized management systems, restricting internet access to administrative interfaces, rapidly patching vulnerabilities, and centralizing logs with longer retention.
They also advise monitoring for unusual administrative activity, reviewing trusted connections that could expose customer or partner networks, and following CISA and NCSC guidance on Volt Typhoon.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report
