In a deep dive into the Silent Train attack tactic used by China’s Volt Typhoon cybercrime group, Lumen’s Black Lotus Labs highlighted evidence of efforts to pre-position access within what it described as “strategic communications, critical infrastructure and other ecosystems that become essential during geopolitical tensions or crises.” The report, released on Wednesday, said that Silent Train is built around “rapidly rotating chains of compromised SOHO, IoT and enterprise devices that are exploited on demand, used against carefully selected targets, cleaned up after each operation and continuously refreshed. This approach allowed Volt Typhoon to carry out exploitation and post-exploitation activity securely while reducing the risk of detection, attribution, and disruption.”Multiple intrusions via Silent Train have been confirmed in the wild, Lumen said, all on high value targets.Its report described at least four confirmed and one likely zero-day vulnerabilities exploited by Volt Typhoon, which targeted network and endpoint management systems, SD-WAN orchestrators and control plane infrastructure that provide visibility, administration and access across enterprise and customer environments. It noted that victims included telecommunications providers, government, defense contractors, satellite and mission-critical communication services, universities, IT firms and critical infrastructure such as water, energy, transportation, maritime, rail, aviation, emergency services and other essential operations.Lumen said the nature of these victims “indicates deliberate efforts to maintain access to critical ecosystems that support defense, logistics, communications, military and civilian operations, especially during heightened tensions or crises in the Indo-Pacific region.”Although the Silent Train attack has been in the wild for years and was tracked by various cybersecurity teams, the level of operational details that Lumen reported Wednesday went well beyond what had been known. In fact, Frank Dickson, principal analyst at Dickson Research, who tracks this space, said the Lumen report “may be one of the most valuable pieces of research published this year.”Key findingsSome of the report’s key findings described the surprising speed and efficiency of the attacks. “Sessions were often remarkably efficient. Operators could exploit and assemble chains of devices in under two minutes, and on their way out they would leave no evidence for defenders to uncover,” Lumen said. “Their operational tempo suggests the use of a semi-automated, on-demand provisioning process.” But a strict process remained consistent throughout many attacks, it pointed out.“Another noteworthy aspect was Volt Typhoon’s consistent assignment of specific device types to positions within Silent Train chains,” the report said. “We noticed that device types were reserved for specific operational roles that never deviated. Intelbras modems only appeared as overseas relay nodes, while Netgear Orbi devices served as US-based hops that interacted with victims. Similar patterns appeared across every other device type in Silent Train.”It observed that, despite having enough global infrastructure to swap device types between overseas and US hops, Volt Typhoon maintained these fixed roles throughout three years of monitoring, and its VPS infrastructure also used separate providers and locations rather than a shared environment.The report concluded that attack infrastructure “was deliberately compartmentalized across layers, complicating attribution and reducing the risk that access to one device or provider would expose more of the network. The underlying infrastructure changed constantly, but the architecture and role of each layer remained highly structured.”Laying the foundationAnalysts and consultants noted that the attacks didn’t necessarily engage in damage or theft initially, but instead laid a foundation for a later attack.“I wouldn’t say this is necessarily a novel approach, but it is a clever one,” said Sav Wheeler, malware research engineer at Malwarebytes. “Holding off on taking advantage of compromised resources until an opportunity presents itself is itself a strategic form of resource management.”Mike Wilkes, enterprise CISO at Aikido Security, agreed that the delayed gratification is a dangerous attack group tactic.“P0wning th,e control plane of telecommunications and critical infrastructure is both logical and, sadly, often rather easy” he said. “Why attack individual systems when you can compromise the infrastructure that manages, connects and authenticates them? The strategic objective isn’t necessarily immediate disruption. It’s establishing the ability to disrupt, manipulate or deny services at a time of geopolitical advantage.”Dickson also agreed, saying that the published details show a pattern that “is not espionage for its own sake. It looks like access being banked for a crisis in the Pacific.”Rethink defenses“That breaks the usual defender playbook,” Dickson said. “A blocklist does nothing against an address that was a relay for four hours last Tuesday. The indicators expire before anyone can publish them. This is also a direct response to the KV-botnet takedown. Take out the bridge and they build a ferry.” He added, “a network management console is built to see everything, reach everything, and change everything. Those are exactly the powers an attacker wants. We spent a decade building higher castle walls and then hung the master key ring by the gate.”But it is the speed of Silent Train that worries Dickson the most. Although an enterprise can’t out-rotate an adversary that rebuilds its network in two minutes, “it can make the destination much harder to reach. Take every management console, SD-WAN orchestrator, and admin portal off the open internet and put it behind a VPN, a jump host, or a dedicated management network. Patch control plane technology first, not last,” he advised.Aman Mahapatra, chief strategy officer for New York City-based technology consulting firm Tribeca Softech, said the implications of the Silent Train deep dive will force CISOs to rethink much of their defensive strategies. “IP-based defenses are nearing the end of their usefulness against this class of adversary. When the network origin is disposable, identity, behavior, and timing are what remain visible,” he said. “An adversary willing to burn an exploit on a router to protect an exploit on an SD-WAN orchestrator is telling defenders exactly how much that access is worth.”Another concern, said Mahaptra, is revealed by the way Lumen was able to detect much of the attack methodology, something that will likely elude most enterprise SOCs. “Lumen detected Silent Train because a backbone carrier can see the entire chain,” Mahapatra said. “No single enterprise ever sees more than its own segment. Organizations in the sectors on this victim list should formalize threat notification arrangements with their carriers, because the detection that worked here happened outside every victim’s network.”He advised enterprises to also watch their own edge devices for outbound behavior. Lumen documented FortiGate and Cisco appliances, PRTG, CyberPanel and even Mirth Connect healthcare integration servers serving as final hops, some for one to three months, he pointed out; outbound SSH to unfamiliar hosts, reverse tunnels built with tools such as Chisel or FRP, and traffic on unusual high ports “can indicate that a company’s appliance is serving as the attacker’s domestic face for an intrusion elsewhere.”Mark Child, an associate research director with IDC, also is concerned about the tactical methods of Silent Train.“Silent Train abandons persistence,” Child said. “Instead of maintaining a permanent network, Volt Typhoon rapidly assembles and dismantles transient infrastructure. This makes it more effective against network-centric defenses: IP blocklists, threat-intel feeds of IOC addresses, geofencing, and takedowns. Those all assume infrastructure that sticks around.”However, he noted, “it is not more effective against good endpoint and behavioral detection on the target.” No matter many hops there are, the exploitation, credential theft and admin-tool abuse still execute on the server. “The real force multiplier is the choice of target,” he said. “Hitting a management platform delivers admin access to thousands of devices and trusted paths to downstream customers, with no lateral movement, which removes the lateral movement signals EDR usually relies on. For endpoint security teams, IP-based detection loses value here. Behavioral monitoring of privileged management servers, and what they do to endpoints, becomes the decisive control.”