US Researchers Track Chinese Hackers Through Silent Network Loops

Network defenders in the United States have spent years trying to keep pace with state-sponsored cyber threats that operate with low visibility. A new analysis by Lumen's Black Lotus Labs has mapped out a specific, repeatable method used by a Chinese government hacking group known as Volt Typhoon to infiltrate key strategic networks.

The team led by Michael Horka, a principal information security analyst at Lumen, identified a pattern they call Silent Train. Horka described the process as a complex exercise in thread pulling that eventually revealed a reproducible network signature. The hackers construct a winding pathway through up to six different virtual networks and compromised devices, such as routers, to reach their destination. They never retrace their steps and use previously undiscovered vulnerabilities to move through the systems. After reaching their target, they cover their tracks behind them to remain extremely quiet.

Lumen is a major telecommunications company that helps route network traffic across the internet. While attackers can obscure some of their digital footprints, they cannot hide them entirely. Horka noted that the investigation often felt like a wild goose chase, but the team was able to track the threat actors as they traversed the global network infrastructure.

U.S. national security officials have identified Volt Typhoon as a group focused on gaining secret access to high-value targets. Horka listed the primary sectors of interest as government, defense, telecommunications, and critical infrastructure. This includes water systems, rail networks, and aviation. These targets are valuable for intelligence gathering, but they also offer the potential for physical damage. An adversary could shut off power or cut off access to ports, creating societal panic or slowing the U.S. military's response in a conflict.

The team found that the hackers have become more stealthy over time. They created a roadmap for accessing these critical networks that allows them to maintain persistent access without triggering standard alarms. The use of novel tactics and zero-day vulnerabilities demonstrates a high level of motivation and resource investment from the attacking group.

Horka argued that network defenders and threat hunters need to match the investment level of the attackers. He suggested that defenders must think like adversaries to identify what would be valuable to an organization and, by extension, what would make it a likely target. Exposing the specific trade craft of Volt Typhoon is intended to make it harder for the group to operate undetected in the future.

Horka used the analogy of a stagnant pond to describe the current state of cyber defense. He said the team is dropping a rock into the water to see what happens. The goal is to create ripples that force other actors in the space to react and adjust their positions. Horka plans to continue monitoring the network traffic to observe how the hacking group responds to the public disclosure of their Silent Train methodology.