[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGM9phBKXi6FOp-BqnRkOLUZueTnAICcSkAqkrehps_E":3},{"article":4,"iocs":54,"watch_terms":62,"solutions":63,"lesson":158},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"dfa9235e-1b8d-43ec-8364-77e395ce5eb8","Chinese Hackers Use Secret Silent Train Network to Exploit Zero-Days Against U.S. Government and Defense","chinese-hackers-use-secret-silent-train-network-to-exploit-zero-days-against-u-s-115eb8","China-linked Volt Typhoon hackers have used a covert network called Silent Train to hide zero-day attacks against U.S. government agencies, defense contractors and critical infrastructure. The network chains together compromised routers, connected devices and enterprise servers, helping operators reach sensitive systems while concealing where their activity begins. The investigation connects years of carefully targeted intrusions […] The post Chinese Hackers Use Secret Silent Train Network to Exploit Zero-Days Against U.S. Government and Defense appeared first on Cyber Security News.","Chinese threat actor Volt Typhoon has been utilizing a covert network named Silent Train to conceal zero-day attacks targeting U.S. government agencies, defense contractors, and critical infrastructure. This operational framework chains together compromised routers, connected devices, and enterprise servers to mask the origin of their activity. Researchers have tracked this sophisticated operation for over three years, identifying multiple zero-day campaigns that exploited vulnerabilities in centralized management platforms.","Volt Typhoon hackers used Silent Train network to hide zero-day attacks against US government and defense.","https:\u002F\u002Fcybersecuritynews.com\u002Fchinese-hackers\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002FChinese-Hackers-Use-Secret-Silent-Train-Network-to-Exploit-Zero-Days-Against-U.S.-Government-and-Defense.webp","2026-10-29T12:48:55+00:00","2026-10-29T13:00:18.274945+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"Volt Typhoon","threat_actor",{"name":21,"type":22},"N-central","product",{"name":24,"type":22},"Versa Director",{"name":26,"type":22},"Cisco Catalyst SD-WAN",{"name":28,"type":22},"VeloCloud Orchestrator",{"name":30,"type":22},"Quest KACE","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":31,"icon":33,"name":34,"slug":35},null,"Nation-state","nation-state",[37,42,47,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59],{"type":56,"value":57,"context":58},"malware","Silent Train","Covert network framework used by Volt Typhoon",{"type":56,"value":60,"context":61},"in-memory webshells","Malicious payloads deployed by Silent Train",[21,24,26],{"controls":64,"vendors":151},[65,94,123],{"slug":66,"name":67,"problem":68,"products":69},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":95,"name":96,"problem":97,"products":98},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"slug":53,"name":124,"problem":125,"products":126},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[127,135,143],{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",[152],{"slug":153,"name":154,"logo_path":155,"roles":156},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png",[157],"affected",{"slug":159,"title":160,"body":161,"framework_refs":162,"framework_notes":170},"volt-typhoons-silent-train-network-exploits-zero-days-against-us-targets","Volt Typhoon's Silent Train Network Exploits Zero-Days Against U.S. Targets","The Volt Typhoon campaign demonstrates how nation-state actors can chain compromised infrastructure into covert proxy networks to launch zero-day attacks while obscuring their origins. By exploiting unpatched vulnerabilities in centralized management platforms — systems that touch wide swaths of an organization's environment — attackers gained outsized access with minimal detection risk. The three-year duration of this campaign underscores a critical failure: organizations were neither discovering the zero-days quickly enough nor limiting the blast radius through proper network segmentation. Zero-day exploitation is difficult to prevent entirely, but reducing dwell time, isolating critical systems, and monitoring for anomalous lateral movement are essential compensating controls. Without these layers of defense, even a single compromised edge device becomes a launchpad into the heart of sensitive government and defense networks.",[163,164,165,166,167,168,169],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","MITRE ATT&CK T1090: Proxy","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":171,"MITRE ATT&CK T1090: Proxy":172,"NIST SP 800-53 SI-2: Flaw Remediation":173,"CIS Control 12: Network Infrastructure Management":174,"CIS Control 7: Continuous Vulnerability Management":175,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":176,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":177},"NIS2 mandates incident handling and vulnerability disclosure obligations for operators of essential services; the three-year undetected campaign against critical infrastructure illustrates exactly the gap this article is designed to close.","The Silent Train network is a textbook multi-hop proxy chain used to obscure attacker origin; mapping defenses to this technique — including egress filtering and traffic behavioural analysis — would have aided detection of the covert infrastructure.","SI-2 requires organizations to identify, report, and correct information system flaws; applying this control to the exploited management platforms would have mandated timely patching and risk-acceptance procedures when patches were unavailable.","Volt Typhoon chained compromised routers and enterprise servers into a covert relay network, highlighting the need for rigorous hardening, inventory, and monitoring of all network infrastructure devices.","Zero-day vulnerabilities in centralized management platforms were exploited over a multi-year campaign; a mature continuous vulnerability management program — including rapid patch cycles and compensating controls when patches are unavailable — would have reduced the window of exposure.","This control requires organizations to obtain timely information about technical vulnerabilities and take appropriate action; applying it to management platforms would have driven faster response to the zero-days Volt Typhoon exploited.","Restricting and rigorously authenticating access to centralized management platforms would have limited Volt Typhoon's ability to pivot across victim environments after initial exploitation."]