Security researchers have disrupted a proxy network of compromised devices operated by Chinese nation-state hacking group Volt Typhoon, which was used to target victims across multiple sectors, including governments.
Lumen’s Black Lotus Labs uncovered the network dubbed Silent Train, which consisted of SOHO, IoT and enterprise devices used to carry out exploitation and post-exploitation activity securely.
“Over three years, we notified hundreds of victims in key sectors and supported investigations that uncovered at least one likely and four confirmed zero-day campaigns targeting endpoint and network management systems, SD-WAN, out-of-band platforms and other control plane infrastructure,” Black Lotus Labs said.
The hacking group predominantly targeted victims in the US across telecommunications, defense, government, managed service providers and critical infrastructure, with Hawaii, California and Texas the most targeted states.
Unlike traditional botnets that rely on continued access to a specific set of compromised devices, Silent Train rapidly assembled and dismantled chains of compromised devices, and compartmentalized its infrastructure to evade detection. Volt Typhoon also carried out extensive cleanup after each operation.
“The underlying infrastructure changed constantly, but the architecture and role of each layer remained highly structured,” Black Lotus Labs said.
Zero-days in management platforms
Chinese hacking groups, particularly Volt Typhoon, have been known to target management platforms for stealth operations, as compromising them gives the threat actors the advantage of reducing interactions with hosts, while minimizing forensic artifacts.
In the Silent Train operations, the group focused on selective targets to carry out specific operations in a limited window of time. As a result, a key attack vector for the group was zero-day exploits in endpoint and network management, out-of-band administration and SD-WAN platforms, Black Lotus Labs said.
These include a likely zero-day in Quest KACE, a suite of unified endpoint and IT systems management solutions; a flaw in orchestration platform Versa Director; two zero-days in N-able N-Central; a Cisco Catalyst SD-WAN flaw; and another zero-day in VeloCloud Orchestrator, which is a centralized controller for SD-WAN deployment.
To prevent potential compromise, Black Lotus Labs recommends that organizations deploy heightened security controls to network and endpoint management systems, SD-WAN orchestrators and out-of-band platforms.
It also recommends continuously reviewing and minimizing internet-facing systems, as well as restricting direct access to administrative interfaces.
