Analysts Identify 6-Step Pattern in Volt Typhoon Infiltrations

Network defenders have identified a specific, repeatable pattern used by Chinese government hackers to access critical U.S. infrastructure. The discovery offers a concrete signature for threat hunters to detect intrusions that have historically been difficult to spot.

The hacking group, known as Volt Typhoon, has targeted government and defense sectors, telecommunications, water systems, rail, and aviation for years. U.S. national security officials describe these targets as strategic for intelligence gathering and for the potential to cause physical disruption, such as power outages or port closures, during a conflict.

Michael Horka, a principal information security analyst at Lumen's Black Lotus Labs, described the detection process as a long investigation into network traffic. His team monitors the backbone of the internet to identify and track nation-state and criminal threat actors. Horka noted that the work often felt like a wild goose chase before the team connected enough data points to form a clear picture.

The researchers named the intrusion method Silent Train. The hackers construct a winding path through up to six different virtual networks and compromised devices, such as routers, to reach their final destination. They use previously undiscovered vulnerabilities and cover their digital tracks behind them. This approach ensures they never retrace their steps, keeping the operation extremely quiet.

Horka stated that the group is highly motivated and willing to invest heavily in these operations. He emphasized that defenders must match that effort by thinking like attackers. He advised network defenders to consider which assets are most valuable to their organization and assume those assets are primary targets.

The exposure of this trade craft aims to disrupt the group's ability to hide. Horka compared the action to dropping a rock into still pond water to observe the ripples. He intends to watch how the group responds to the public disclosure of their methods.

Lumen, a major telecommunications company, routes network traffic and provides the data infrastructure for this analysis. The team's ability to signature the network pattern allows other defenders to look for the same reproducible behavior in their own systems.