Volt Typhoon’s relay chains conceal reach into control systems
Lumen’s Black Lotus Labs says Volt Typhoon used its Silent Train framework, tracked for more than three years, in four confirmed and one likely zero-day campaigns targeting U.S. critical infrastructure and other strategic organizations. The campaigns targeted network and endpoint management systems, software-defined wide area network (SD-WAN) orchestration, and related centralized control systems; victims included telecommunications providers, government agencies, defense contractors, and critical infrastructure operators.
Instead of connecting directly, the group routed activity through rapidly rotated chains of compromised home-office, Internet of Things (IoT), and enterprise devices, making traffic harder to trace. Black Lotus Labs says operators also used exposed web interfaces and temporary tunnels, then removed operational artifacts. The relays conceal the route, while a compromised management platform can provide administrative access to downstream systems.
For organizations whose management or SD-WAN platforms administer connected networks, a foothold can expose systems and customers beyond the device carrying the relay; host-level cleanup alone may not account for that wider reach.