[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f88VnlZaCCOmuDiWrJ3X4rSRTmOxJUL3FoFARJ-r0tsc":3},{"article":4,"iocs":55,"watch_terms":59,"solutions":60,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"e56d3c8a-8e46-4362-a864-50499e6a7996","Researchers uncover Volt Typhoon’s covert, ephemeral network","researchers-uncover-volt-typhoon-s-covert-ephemeral-network-2169d8","The China-linked threat group has used the “Silent Train” framework, built on a series of rapidly rotating compromised devices, to infiltrate hundreds of critical infrastructure networks. The post Researchers uncover Volt Typhoon’s covert, ephemeral network appeared first on CyberScoop.","China-linked threat group Volt Typhoon has been using a rapidly rotating network of compromised devices, dubbed 'Silent Train,' to infiltrate hundreds of critical infrastructure networks. This ephemeral infrastructure, rebuilt in under two minutes, makes detection and tracing extremely difficult, with sessions averaging only four hours. The group has exploited various device classes and zero-days, targeting sectors like telecom, government, defense, and energy.","Volt Typhoon uses ephemeral network 'Silent Train' to infiltrate critical infrastructure.","https:\u002F\u002Fcyberscoop.com\u002Fvolt-typhoon-silent-train-covert-ephemeral-network-black-lotus-labs\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2021\u002F11\u002FGettyImages-sb10069087f-001.jpg","2026-10-28T16:00:00+00:00","2026-10-28T17:00:09.239294+00:00",9,[17,20,23,26,28,30],{"name":18,"type":19},"Volt Typhoon","threat_actor",{"name":21,"type":22},"Lumen Technologies","vendor",{"name":24,"type":25},"Silent Train","product",{"name":27,"type":25},"Fortinet",{"name":29,"type":25},"Cisco",{"name":31,"type":25},"ManageEngine","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":32,"icon":34,"name":35,"slug":36},null,"Nation-state","nation-state",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56],{"type":57,"value":24,"context":58},"malware","Framework used by Volt Typhoon for covert access",[21,24,27],{"controls":61,"vendors":147},[62,90,119],{"slug":63,"name":64,"problem":65,"products":66},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":85,"url":88,"description":89},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"slug":91,"name":92,"problem":93,"products":94},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"slug":54,"name":120,"problem":121,"products":122},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[123,131,139],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",[],{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":160},"volt-typhoons-silent-train-exposes-critical-infrastructure-via-ephemeral-proxy-networks","Volt Typhoon's 'Silent Train' Exposes Critical Infrastructure via Ephemeral Proxy Networks","China-linked Volt Typhoon has built a covert, rapidly rotating network of compromised edge devices — dubbed 'Silent Train' — that can be fully rebuilt in under two minutes, with individual sessions lasting only about four hours. This ephemeral design is specifically engineered to defeat traditional detection, attribution, and tracing methods that rely on static indicators of compromise. The group exploited multiple zero-day vulnerabilities across device classes in telecom, energy, defense, and government sectors, demonstrating that unpatched edge devices are a primary attack surface for nation-state actors. The incident matters because critical infrastructure defenders are fighting a moving target: by the time logs are reviewed and alerts fire, the infrastructure has already rotated and evidence has evaporated.",[153,154,155,156,157,158,159],"CIS Control 7: Continuous Vulnerability Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1090: Proxy","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":161,"MITRE ATT&CK T1090: Proxy":162,"NIST SP 800-53 SI-2: Flaw Remediation":163,"CIS Control 13: Network Monitoring and Defense":164,"CIS Control 7: Continuous Vulnerability Management":165,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":166,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":167},"NIS2 requires essential and important entities to implement incident handling and network monitoring measures proportionate to their risk; the targeted sectors (energy, telecom, government) are squarely covered and would be obligated to maintain the detection capabilities that could have surfaced this campaign.","Volt Typhoon's Silent Train is a textbook implementation of multi-hop proxy chaining through compromised devices; explicit detection engineering against T1090 sub-techniques in SIEM\u002FNDR tools would have surfaced this activity pattern earlier.","SI-2 requires organizations to identify, report, and correct information system flaws; applying this control to edge and OT-adjacent devices would have patched the vulnerabilities Volt Typhoon leveraged for initial access.","The ephemeral four-hour session windows mean defenders must have real-time network traffic analysis in place, as retrospective log reviews alone are insufficient to detect and respond before the infrastructure rotates.","Volt Typhoon exploited zero-days and known vulnerabilities in edge devices; a rigorous, continuous vulnerability management program with prioritized patching of internet-facing assets would have reduced the exploitable attack surface before intrusion.","This control mandates timely identification and remediation of technical vulnerabilities across all assets, which, if applied to network appliances in critical infrastructure, would have closed the entry points used to build Silent Train.","Compromised edge devices were used as trusted relay nodes; enforcing strong device identity and continuous authentication would have flagged or blocked unauthorized relay behavior within the network perimeter."]