Volt Typhoon, a China-nexus cyber espionage group, operates through a covert access network known as Silent Train, which was first identified in late 2023.
Silent Train facilitates vulnerability exploitation, credential access, and data exfiltration across various sectors, including telecommunications, government, and defense contractors. The network uses compromised SOHO, IoT, and enterprise infrastructure to maintain access to victim environments.
Volt Typhoon has been active since at least 2021, focusing on critical infrastructure sectors such as communications, energy, transportation, and water. The group has exploited at least four confirmed zero-day vulnerabilities, including CVE-2024-39717 and CVE-2025-8875.
The operational model of Silent Train involves rapidly rotating chains of compromised devices, which are cleaned up after each operation to minimize detection. This approach allows Volt Typhoon to conduct operations with exceptional operational security, making disruption difficult.
The group has been linked to the use of various devices, including products from TP-Link, Netgear, Cisco, and Fortinet. Their activities have been described as pre-positioning for potential conflict scenarios, particularly regarding Taiwan.
Researchers from Black Lotus Labs have been tracking Volt Typhoon's activities for three years. The group's operations have raised concerns about the potential for disruption of critical infrastructure during geopolitical tensions.