Lumen Researchers Identify New Tactics Used by Chinese Hackers

A team of security analysts at Lumen has identified a new method used by Chinese government hackers to infiltrate critical U.S. Networks.

The researchers, based in Lumen's Black Lotus Labs, have been tracking digital footprints left by the Volt Typhoon group. Michael Horka, a principal information security analyst at the firm, led the effort to identify and track these threat actors.

Volt Typhoon has targeted strategic sectors for years. Horka listed government and defense agencies, telecommunications, water systems, rail lines, and aviation as primary targets. U.S. National security officials stated that the group aims to gain secret access to these systems for intelligence gathering. The group could also use these connections to cause physical damage, such as shutting off power or cutting port access, which would create societal panic or slow a military response during a conflict.

The hackers have changed how they move through networks. Horka described the process as a wild goose chase that eventually revealed a reproducible pattern. The team labeled this pattern Silent Train.

The Silent Train method involves creating a winding pathway through up to six different virtual networks. The hackers also use compromised devices, such as routers, to reach their destination. They never retrace their steps during a single intrusion.

The group relies on previously undiscovered vulnerabilities to move. They cover their tracks behind them as they proceed. Horka said the hackers were purposely trying to stay extremely quiet during these operations.

Lumen helps route network traffic along the backbone of the internet. While hackers can hide some of their activity, they cannot remove all digital footprints. Horka said his team identified the pattern by pulling on many threads of network data until the reproducible behavior became clear.

Horka noted that the hackers are highly motivated and willing to invest heavily in these operations. He urged network defenders to adopt a similar mindset. He told them to think like the attackers and consider what assets in their organization would be valuable targets.

The exposure of the Volt Typhoon trade craft aims to make it harder for the group to hide. Horka used the analogy of dropping a rock into still pond water to describe the team's public disclosure. He said the goal was to see what happens after the disruption.

The analysts will continue to watch the network for ripples from this disclosure. The work was News, which detailed the findings of Black Lotus Labs.