Lumen Links Volt Typhoon's Silent Train Relay Network to Four Zero-Days
A covert relay network that Lumen's Black Lotus Labs has tracked for three years — and attributed to the China-linked APT group Volt Typhoon — was used in connection with zero-day attacks against critical systems, with the firm tying the infrastructure to at least four zero-days, Security Affairs reported on [source publication date].
One caveat belongs up front: the coverage summarised here does not state whether the relays carried initial exploitation or only post-exploitation command-and-control. This article does not assume either reading.
The network, dubbed "Silent Train," is built around disposable relay chains: short-lived proxy and relay nodes that are rotated out before defenders can build durable blocklists. Because the infrastructure is designed to be thrown away, conventional IP and domain reputation defences lose their purchase almost as soon as an indicator is published.
Three years of infrastructure tracking
According to Security Affairs, Black Lotus Labs spent three years mapping Silent Train's operational footprint before connecting it to Volt Typhoon, a group widely attributed by CISA and allied governments to pre-positioning inside critical-infrastructure networks for potential disruptive activity. The firm linked the relay network to at least four zero-day vulnerabilities; the specific CVEs were not identified in the coverage.
The attribution matters because it joins two threads that defenders have often treated separately: Volt Typhoon's living-off-the-land, long-dwell intrusion tradecraft, and the disposable network plumbing that lets such operators reach targets without leaving stable indicators behind.
Why blocklists fail against Silent Train
Silent Train's design is the point. Relay chains that rotate on a rapid cadence defeat IP/domain blocklists by construction: by the time an address is observed, correlated, and blocked, the chain has moved on. For security operations teams defending critical systems, that shifts the durable defensive pivot from indicator-based filtering to behavioural and traffic-pattern detection at the network edge.
The detection angles below are HKLUG's own analysis for network-monitoring teams, not recommendations published by Lumen:
- Rotation cadence — outbound connections to infrastructure that changes on a short, regular schedule rather than the gradual churn of legitimate CDN or cloud egress.
- TLS anomalies — certificate lifetimes, cipher choices, or session patterns inconsistent with the claimed destination, and long-lived TLS sessions to rarely seen hosts.
- Hop routing — traffic that traverses a consistent, unusual relay path to reach otherwise unrelated destinations, or internal-to-internal flows that detour through external relay space.
None of these are single-shot detections; each is a correlation problem, which argues for sustained flow-record retention rather than reactive alerting on freshly published indicators.
What this does not say
The Security Affairs coverage identifies no specific organisations, sectors, or jurisdictions compromised through Silent Train, and this article draws no conclusions about local networks or operators. Hong Kong IT professionals working in critical-infrastructure defence will find the tradecraft directly relevant to their own monitoring posture — but as a general observation about the technique's applicability, not a claim about any local incident.
The practical takeaway for SOC teams is straightforward: infrastructure-blocklist workflows remain useful as a hygiene layer, but they cannot be the primary defence against an actor whose relay network is engineered to be disposable. Behavioural detection of rotation cadence, TLS anomalies, and hop routing at the network edge — sustained over time, matched against known Volt Typhoon living-off-the-land activity — is the more durable path.
Source: Security Affairs, "Volt Typhoon Used Silent Train to Hide Zero-Day Attacks," [source publication date].
Lumen 將 Volt Typhoon 的 Silent Train 中繼網絡與四宗零日攻擊關聯
Lumen 旗下的 Black Lotus Labs 追蹤近三年、並歸因於與中國關聯的 APT 組織 Volt Typhoon 的一個秘密中繼網絡，曾被用於針對關鍵系統的零日攻擊；該公司已將此基礎設施與至少四宗零日漏洞關聯，Security Affairs 於 [原文刊登日期] 報道。
有一點須先說明：此處概述的報道並未指出這些中繼節點承載的是初始漏洞利用（initial exploitation），還是僅為入侵後的 command-and-control。本文不會預設任何一種解讀。
該網絡被命名為「Silent Train」，其核心是可棄置的中繼鏈（relay chain）：壽命短暫的 proxy 及 relay 節點，會在防禦者來得及建立持久 blocklist 之前便被輪換掉。由於這套基礎設施在設計上就是要被丟棄，傳統的 IP 及域名信譽防禦幾乎在任何 indicator 一經公布之際便已失效。
三年的基礎設施追蹤
據 Security Affairs 報道，Black Lotus Labs 花了三年時間描繪 Silent Train 的運作版圖，其後才將其與 Volt Typhoon 關聯——該組織被 CISA 及盟邦政府普遍歸因為在關鍵基礎設施網絡內預先部署（pre-positioning），以圖發動潛在的破壞性行動。該公司把這一中繼網絡與至少四宗零日漏洞關聯；有關報道並未指出具體的 CVE 編號。
此一歸因之所以重要，在於它串連起防禦者向來往往分開處理的兩條線索：Volt Typhoon 採用 living-off-the-land、長期潛駐（long-dwell）的入侵手法，以及那套令此類攻擊者得以接觸目標、卻不留下穩定 indicator 的可棄置網絡管線。
為何 blocklist 對付不了 Silent Train
Silent Train 的設計正是關鍵所在。快速輪換的中繼鏈在結構上便足以破解 IP／域名 blocklist：當一個地址被觀察、關聯並加以封鎖之時，該鏈早已轉移。對於防守關鍵系統的 security operations 團隊而言，這意味著持久防禦的着力點須由 indicator 驅動的過濾，轉向網絡邊緣（network edge）上的行為及流量模式偵測。
以下偵測角度乃 HKLUG 自行針對網絡監控團隊所作的分析，並非 Lumen 公布的建議：
- 輪換節奏（Rotation cadence） — 對外連接所指向的基礎設施以短促而規律的時間表變動，而非如正當 CDN 或云端出口（cloud egress）般逐步更替。
- TLS 異常（TLS anomalies） — certificate 有效期、cipher 選擇或 session 模式與所宣稱的目的地不一致，以及通往鮮見主機的長時間 TLS session。
- 跳躍式路由（Hop routing） — 流量經由一條固定而異常的中繼路徑抵達本來互不相關的目的地，或內對內（internal-to-internal）的流量繞經外部中繼空間。
以上沒有一項可以一擊即中；每一項都是關聯（correlation）問題，因此應當持久保留 flow record，而非對新公布的 indicator 作被動式告警。
本文沒有說的
Security Affairs 的報道並未指明有哪些特定組織、行業或司法管轄區透過 Silent Train 遭入侵，本文亦不就本地網絡或攻擊者作出任何結論。在香港從事關鍵基礎設施防禦的 IT 專業人士，會發覺該手法與自身的監控部署直接相關——但這只是關於該技術適用性的一般觀察，並非對任何本地事件的指控。
對 SOC 團隊而言，實際的啟示很直接：以基礎設施 blocklist 為流程的作業，作為衛生層（hygiene layer）仍然有用，但面對一個中繼網絡被刻意設計為可棄置的攻擊者，它不可能成為主要防線。在網絡邊緣對輪換節奏、TLS 異常及跳躍式路由進行行為偵測——並持之以恆，與已知的 Volt Typhoon living-off-the-land 活動相比對——才是更為持久的路徑。
Source: Security Affairs, "Volt Typhoon Used Silent Train to Hide Zero-Day Attacks," [原文刊登日期].