From BigGo Finance · BigGo Finance · · 1m 20s
China-Linked 'Volt Typhoon' Exploited 4 Zero-Days
China's cyberattack group used a stealth relay network to exploit four zero-day vulnerabilities in critical infrastructure systems.
In brief
China's cyberattack group used a stealth relay network to exploit four zero-day vulnerabilities in critical infrastructure systems. China-linked Volt Typhoon group exploited four zero-days in management products affecting US critical infrastructure. Originally reported by BigGo Finance.
Silent Train Network
Black Lotus Labs identified a stealth relay network used by China-linked Volt Typhoon group.
Four Zero-Day Exploits
The group exploited four zero-days in management products including Cisco Catalyst SD-WAN and Versa Director.
Affected Organizations
Hundreds of organizations across critical infrastructure were impacted, with US victims concentrated in Hawaii, California, and Texas.
Three-Year Tracking
Black Lotus Labs monitored Silent Train since November 2023, tracking it for three years.
Product Vulnerabilities
Four products confirmed with zero-days: Versa Director, N-central, Cisco Catalyst SD-WAN, and Arista VeloCloud Orchestrator.
Relay Network Mechanism
The network used compromised routers and IoT devices to route traffic globally while evading detection.
Device Usage Patterns
Over 27 device types were used, including SOHO and IoT devices from TP-Link, NETGEAR, and Cisco.
Short-Lived Operations
Each relay session lasted four hours with traces erased after use to avoid detection.
Geographic Impact
Hawaii, California, and Texas were especially affected due to military and infrastructure concentration.
The bottom line
China-linked Volt Typhoon group exploited four zero-days in management products affecting US critical infrastructure.
