[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQXoZMW0PqwXHhdbEVOmgZhVeTRY-f2jKhcz4pG6vahI":3},{"article":4,"iocs":56,"watch_terms":61,"solutions":62,"lesson":157},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"82d7d281-d1c1-4c50-846c-67cfd02df630","Volt Typhoon Used Silent Train to Hide Zero-Day Attacks","volt-typhoon-used-silent-train-to-hide-zero-day-attacks-c9f2d1","Volt Typhoon used disposable relay chains to hide zero-day attacks on critical systems. Lumen linked Silent Train to at least four zero-days. Lumen’s Black Lotus Labs has spent three years tracking a covert network it calls Silent Train, which it ties to Volt Typhoon, the China-linked APT group. The cybersecurity firm says the network hid […]","Volt Typhoon, a China-linked APT group, has been tracked by Lumen's Black Lotus Labs using a covert network called Silent Train. This network has been used to exploit at least four confirmed zero-day vulnerabilities in critical systems, leveraging disposable relay chains of compromised devices to mask their activity. The group rapidly changes these chains, often using a mix of home, IoT, and enterprise devices, to maintain access and evade detection.","Volt Typhoon used Silent Train to hide zero-day attacks on critical systems.","https:\u002F\u002Fsecurityaffairs.com\u002F202023\u002Fintelligence\u002Fvolt-typhoon-used-silent-train-to-hide-zero-day-attacks.html","https:\u002F\u002Fsecurityaffairs.com\u002Fwp-content\u002Fuploads\u002F2014\u002F07\u002FChinese-hackers-espionage.jpg","2026-10-29T10:34:54+00:00","2026-10-29T12:00:12.824076+00:00",9,[17,20,23,26,29,31],{"name":18,"type":19},"Volt Typhoon","threat_actor",{"name":21,"type":22},"Silent Train","campaign",{"name":24,"type":25},"Lumen","vendor",{"name":27,"type":28},"Fortinet appliances","product",{"name":30,"type":28},"TP-Link routers",{"name":32,"type":28},"Netgear Orbi devices","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":33,"icon":35,"name":36,"slug":37},null,"Nation-state","nation-state",[39,44,49,51],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":50},{"id":33,"icon":35,"name":36,"slug":37},{"category":52},{"id":53,"icon":35,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[57],{"type":58,"value":59,"context":60},"malware","KV-botnet","Volt Typhoon's earlier network of hijacked routers",[24,27,30],{"controls":63,"vendors":150},[64,93,122],{"slug":65,"name":66,"problem":67,"products":68},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[69,77,85],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":94,"name":95,"problem":96,"products":97},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[98,106,114],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":55,"name":123,"problem":124,"products":125},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[126,134,142],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",[151],{"slug":152,"name":153,"logo_path":154,"roles":155},"fortinet","Fortinet","\u002Fvendor-logos\u002Ffortinet.png",[156],"affected",{"slug":158,"title":159,"body":160,"framework_refs":161,"framework_notes":169},"volt-typhoon-exploits-zero-days-via-covert-relay-network","Volt Typhoon Exploits Zero-Days via Covert Relay Network","Volt Typhoon, a sophisticated China-linked APT group, exploited at least four zero-day vulnerabilities in critical systems while masking their activity through rapidly rotating relay chains of compromised home, IoT, and enterprise devices. The use of disposable infrastructure made attribution and detection extremely difficult, allowing persistent access to persist undetected. Zero-day exploitation combined with a covert relay network represents a dual failure: organizations had no patch available yet also lacked the network visibility needed to detect unusual lateral movement. This matters because critical infrastructure operators must assume that sophisticated adversaries will exploit unknown vulnerabilities, making detection and segmentation controls just as vital as patching.",[162,163,164,165,166,167,168],"CIS Control 7: Continuous Vulnerability Management","CIS Control 17: Incident Response Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1566: Phishing","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":170,"MITRE ATT&CK T1566: Phishing":171,"NIST SP 800-53 SI-2: Flaw Remediation":172,"CIS Control 17: Incident Response Management":173,"CIS Control 7: Continuous Vulnerability Management":174,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":175,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":176},"NIS2 requires essential entities to implement incident handling measures and vulnerability management practices; Volt Typhoon's targeting of critical systems makes compliance with these obligations directly relevant to defending against this threat actor.","While not phishing specifically, the Silent Train relay chain technique maps closely to MITRE ATT&CK's proxy and infrastructure obfuscation tactics (T1090), underscoring the need to detect and model adversary infrastructure behaviors rather than relying solely on signature-based controls.","SI-2 requires organizations to identify, report, and correct information system flaws, including establishing timelines for remediation, which is critical when zero-days emerge in critical infrastructure components.","The covert, long-dwell nature of Volt Typhoon's campaign highlights the need for a tested incident response plan that can detect and contain advanced persistent threats even before a patch exists.","Zero-day vulnerabilities require continuous scanning and rapid response processes; organizations with mature vulnerability management programs are better positioned to apply compensating controls immediately when a zero-day is disclosed.","A.8.8 mandates timely identification and remediation of technical vulnerabilities, and critically, the application of compensating controls when patching is not immediately possible—directly applicable to zero-day scenarios.","Volt Typhoon leveraged compromised devices as relay nodes, meaning stronger device identity verification and access controls would have limited the utility of those compromised endpoints as pivot points."]