Lumen’s Black Lotus Labs has tracked a Volt Typhoon framework it calls Silent Train for three years, and says the Chinese state group used it for at least four zero-days against edge and management gear.
How it works
Traffic goes out through VPS servers outside the U.S., then through chains of compromised devices (Intelbras modems overseas, Netgear Orbi units here) before hitting the target. The chains are built on demand, used against select targets, torn down and refreshed. Targets include telecoms, government, defense, utilities, satellite providers, MSPs and aviation, with California, Texas and Hawaii hit most. It grew partly after the FBI took down Volt Typhoon’s KV-Botnet.
My take
Your router might be somebody’s relay. Update firmware, kill remote admin on SOHO gear, and replace end-of-life boxes. On the enterprise side, keep management interfaces off the internet. That’s where these zero-days live.
God Bless, and Needs Garlic!
