Volt Typhoon's Disappearing Network: How a State-Backed Group Hides Behind Everyday Routers

Volt Typhoon, a hacking group backed by the Chinese government, has been using short-lived, constantly changing infrastructure to break into sensitive systems without being noticed, according to a Wednesday report from Lumen Technologies' Black Lotus Labs. Researchers call the operation "Silent Train". It is not a single network, but a series of compromised small office and home office routers, internet of things devices and enterprise equipment that the group has rapidly rotated through since late 2023.

The group has used these chains to exploit further vulnerabilities, including zero-days, in network edge devices and gain deeper, lasting access to victims. Lead researcher Michael Horka said chains are built and dismantled every day, and that the group can build a new one with different infrastructure in under two minutes. That means the number of active nodes at any moment is close to zero. Sessions averaged roughly four hours, and the group invested heavily in cleanup and compartmentalisation.

Black Lotus Labs has notified hundreds of victims, including telecom providers, government bodies, defence contractors, universities and IT firms. Critical infrastructure victims span water, energy, transport, maritime, rail, aviation and emergency services. Horka cautioned that because the framework is so short-lived, the findings should not be treated as a full count of Volt Typhoon activity. He described the effort as considerable, and aimed purely at making operations hard to discover and trace.