Volt Typhoon targeted enterprise control planes via ever-changing “Silent Train” relay network

Lumen Black Lotus Labs and Cisco Talos describe how Volt Typhoon built a transient, multi-hop relay network called Silent Train—comprised of compromised SOHO/IoT and enterprise devices—to conceal intrusions, exploit zero-days, deploy custom malware (KeyDrift), harvest credentials, erase logs, and exfiltrate sensitive control-plane and operational data from U.S. government, telecom, defense, and critical infrastructure organizations.