Lumen's Black Lotus Labs published its three-year tracking of "Silent Train", a covert access network Volt Typhoon has used since late 2023 for zero-day exploitation and strategic access. The China-nexus group assembles and dismantles disposable chains of compromised SOHO, IoT and enterprise devices in under two minutes, sessions average four hours, and infrastructure is cleaned up and refreshed after each operation — designed to defeat attribution. Research confirmed at least four zero-day campaigns against management platforms including Versa Director, N-Able N-Central, Cisco Catalyst SD-WAN and VeloCloud Orchestrator, and hundreds of victims were notified across telecommunications, government, defence contractors, satellite/communications providers, universities and critical infrastructure. Targeting concentrated on systems offering broad administrative reach — endpoint management, network management, SD-WAN orchestrators, control plane — with Hawaii, California and Texas recurring as focal points. It is the clearest evidence yet that management-platform compromise, not perimeter exploitation, is the China-nexus access battleground.

• Source article