Volt Typhoon Silent Train Campaign: Detection and Hardening Guide for SOHO, IoT, and Enterprise Edge Infrastructure

Lumen Technologies' Black Lotus Labs has published new research attributing a covert operational relay network — dubbed Silent Train — to the China-nexus state-sponsored group Volt Typhoon. First identified in late 2023, Silent Train is a multi-layered proxy infrastructure assembled from rotating chains of compromised small office/home office (SOHO) routers, IoT devices, and enterprise edge infrastructure. According to Black Lotus Labs, the network has been used to support campaigns exploiting unpatched vulnerabilities and to maintain strategic, pre-positioned access to target environments.

The network has now been disrupted, but defenders should treat this as an ongoing threat rather than a closed case. Volt Typhoon has repeatedly demonstrated the ability to rebuild operational relay box (ORB) infrastructure within weeks of takedowns — as seen after the KV-Botnet disruption in late 2023 and subsequent law enforcement actions. Any organization operating internet-facing edge devices, VPN concentrators, firewalls, or SOHO equipment at remote sites must assume that partially patched or end-of-life hardware on their perimeter is a candidate node in the next iteration of this network.

This post breaks down how Silent Train works from a defender's perspective, what to hunt for, and how to harden the device classes Volt Typhoon prefers.

Technical Analysis

What Is Silent Train?

Silent Train is an ORB-style (Operational Relay Box) network: a distributed mesh of compromised devices chained together to proxy command-and-control (C2) and espionage traffic. Rather than registering attacker-owned infrastructure — which is trivially attributable and blockable — Volt Typhoon rides on legitimate-looking IP space owned by ISPs, small businesses, and enterprises. Traffic emerging from a compromised Cisco RV340 at a dental office in Texas or a Fortinet appliance at a regional logistics firm blends into background noise far better than traffic from a bulletproof VPS.

Key characteristics per the Black Lotus Labs reporting:

• Rotating chains: Compromised devices are used in sequence, with nodes swapped in and out. This defeats static IP blocklists and complicates attribution, since a given victim session may traverse multiple compromised hops.
• Mixed device classes: SOHO routers, IoT devices, and enterprise edge gear (VPN gateways, firewalls) are all represented. Enterprise devices are the high-value nodes — they offer bandwidth, stability, and the credibility of corporate IP space.
• Persistence via edge compromise: Initial access is gained through exploitation of unpatched vulnerabilities in internet-facing services — exactly the pattern CISA, NSA, and FBI documented in their February 2024 joint advisory on Volt Typhoon pre-positioning.
• Strategic access staging: Beyond espionage, this infrastructure supports living-off-the-land operations against critical infrastructure sectors — communications, energy, transportation, and water — consistent with Volt Typhoon's assessed mission of pre-positioning for disruptive effects during a geopolitical crisis.

Exploitation Requirements and Status

There is no single CVE at the heart of Silent Train. The attack surface is unpatched edge infrastructure as a class. Volt Typhoon's documented tradecraft exploits known, published vulnerabilities in devices from vendors including Cisco, Fortinet, Ivanti, NETGEAR, and others — frequently N-day flaws with public proof-of-concept code, and frequently on devices that are end-of-life and will never receive a patch.

Exploitation status:

• Confirmed active, in-the-wild exploitation of edge-device vulnerabilities by Volt Typhoon across multiple campaigns spanning 2023–2026.
• Multiple relevant CVEs are in CISA's Known Exploited Vulnerabilities (KEV) catalog — any internet-facing device with a KEV-listed flaw should be treated as a probable target for ORB recruitment.
• Silent Train itself has been disrupted per Black Lotus Labs, but the underlying vulnerability population is untouched. Reconstitution risk is high.

Why This Is Hard to Detect

Volt Typhoon's hallmark is living-off-the-land: minimal malware, extensive use of built-in tools (wmic, netsh, ntdsutil, PowerShell), and C2 that exits through compromised third-party devices on residential and business broadband. On the edge devices themselves, implants often live in memory or abuse legitimate firmware features, surviving little more than a reboot — but the access is re-established through the same unpatched vulnerability.

Detection & Response

The detections below target the two observable layers defenders actually control: (1) Windows endpoint behaviors consistent with Volt Typhoon LOTL tradecraft documented across Silent Train–era campaigns, and (2) edge-device and network telemetry consistent with ORB node behavior — a device proxying traffic volumes or destinations wildly out of profile.

Sigma Rules

---
title: Volt Typhoon LOTL Credential Dumping via ntdsutil or vssadmin
id: 3f9c2a71-8d4e-4b6a-9f13-7c5e2d8a4b01
status: experimental
description: Detects ntdsutil snapshot creation and shadow copy abuse patterns consistent with Volt Typhoon living-off-the-land credential theft on domain controllers and servers.
references:
  - https://attack.mitre.org/techniques/T1003/003/
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.credential_access
  - attack.t1003.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_ntdsutil:
    Image|endswith: '\ntdsutil.exe'
    CommandLine|contains:
      - 'activate instance ntds'
      - 'snapshot'
  selection_vss:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
    CommandLine|contains:
      - 'create shadow'
      - 'shadowcopy'
  condition: selection_ntdsutil or selection_vss
falsepositives:
  - Legitimate backup operations by administrators or backup software
  - Disaster recovery testing
level: high
---
title: Volt Typhoon Web Shell Proxying via netsh Portproxy
id: 6b1e4d92-3c7a-4f58-a2e9-1d8b5c4f7a23
status: experimental
description: Detects netsh interface portproxy configuration, a technique Volt Typhoon has used to relay C2 traffic through compromised Windows hosts and blend with legitimate traffic.
references:
  - https://attack.mitre.org/techniques/T1090/
  - https://attack.mitre.org/techniques/T1090/001/
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.command_and_control
  - attack.t1090.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\netsh.exe'
    CommandLine|contains:
      - 'portproxy'
      - 'add v4tov4'
      - 'add v6tov4'
  filter_legit:
    CommandLine|contains:
      - 'delete portproxy'
  condition: selection and not filter_legit
falsepositives:
  - Rare legitimate port forwarding by network administrators
  - Some WSL2 and development environment configurations
level: high
---
title: Suspicious Management Process Spawned by Web or Edge Service
id: 9c2f7a15-5e3b-4d18-b6f4-2a9e7c1d8f45
status: experimental
description: Detects web server and common edge-service processes spawning shells or scripting engines, consistent with post-exploitation of an unpatched internet-facing service as seen in Volt Typhoon initial access chains.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.persistence
  - attack.execution
  - attack.t1505.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\tomcat\bin\tomcat9.exe'
      - '\java.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Application servers that legitimately invoke scripts (rare; baseline per host)
  - Monitoring agents deployed via web consoles
level: high

KQL — Microsoft Sentinel / Defender

This query hunts the network-layer signature of an ORB node: an internal host or edge device initiating sustained outbound sessions to residential ISP address space or to destinations with no business justification, combined with unusual session symmetry (a proxy forwards roughly what it receives). It assumes firewall or NetFlow data ingested via CEF/Syslog, plus Defender process telemetry for the LOTL layer.

// Hunt 1: LOTL credential-access and proxy tradecraft on endpoints (Volt Typhoon TTPs)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where (FileName =~ "ntdsutil.exe" and ProcessCommandLine has_any ("snapshot", "activate instance ntds"))
   or (FileName =~ "netsh.exe" and ProcessCommandLine has "portproxy" and ProcessCommandLine has "add")
   or (FileName in~ ("vssadmin.exe", "wmic.exe") and ProcessCommandLine has_any ("create shadow", "shadowcopy"))
   or (InitiatingProcessFileName in~ ("w3wp.exe", "httpd.exe", "nginx.exe") 
       and FileName in~ ("cmd.exe", "powershell.exe", "certutil.exe", "bitsadmin.exe"))
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc;

// Hunt 2: Edge devices acting as proxies — high byte symmetry with rare external destinations
// Assumes firewall logs ingested into CommonSecurityLog (CEF). Tune DeviceProduct to your gear.
let EdgeDevices = CommonSecurityLog
    | where TimeGenerated > ago(7d)
    | where DeviceProduct has_any ("Fortigate", "ASA", "PAN", "SRX", "Meraki", "Router")
    | summarize by SourceIP;
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where SourceIP in (EdgeDevices)
| where ipv4_is_private(DestinationIP) == false
| summarize Sessions = count(), TotalSent = sum(tolong(SentBytes)), TotalRecv = sum(tolong(ReceivedBytes)),
            UniqueDests = dcount(DestinationIP), Destinations = make_set(DestinationIP, 25) by SourceIP, DestinationPort
| where UniqueDests < 10 and Sessions > 500
| extend Ratio = todouble(TotalRecv) / todouble(iff(TotalSent == 0, 1, TotalSent))
| where Ratio between (0.7 .. 1.4)   // proxy-like symmetry: forwards roughly what it receives
| order by Sessions desc;

The second hunt keys on a practical heuristic: an edge appliance normally terminates management and inspection traffic (asymmetric, many destinations). A device being ridden as a Silent Train relay shows a small set of destinations, very high session counts, and near 1:1 byte ratios. Baseline first — VPN concentrators will legitimately match parts of this profile.

Velociraptor VQL

Use this artifact across Windows servers (especially domain controllers and management jump boxes) to surface Volt Typhoon LOTL process execution and netsh portproxy persistence in one sweep.

-- Hunt for Volt Typhoon LOTL execution and netsh portproxy persistence
LET proc_hits = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(ntdsutil.*(snapshot|activate instance)|netsh.*portproxy.*add|vssadmin.*create shadow|wmic.*shadowcopy)'
   OR (Name =~ '(?i)(cmd|powershell|certutil|bitsadmin)\.exe'
       AND Exe =~ '(?i)system32')

LET portproxy = SELECT Name, CommandLine
FROM pslist()
WHERE CommandLine =~ '(?i)portproxy'

SELECT * FROM proc_hits
UNION ALL
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime FROM portproxy

For a deeper look, also enumerate the portproxy registry directly with glob() against HKLM\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4\tcp\** via Velociraptor's registry access, and pull Windows.EventLogs around any hits for corroborating 4688/Sysmon 1 events.

Remediation and Verification Script

Run this on internet-facing Windows infrastructure and management hosts to check for portproxy persistence, suspicious scheduled tasks, and shadow-copy tampering. The Bash section covers the Linux/network-gear side: verifying edge devices aren't forwarding traffic they shouldn't be.

# Volt Typhoon LOTL artifact check — run elevated on servers/DCs
Write-Host "=== netsh portproxy listeners ===" -ForegroundColor Cyan
netsh interface portproxy show all

Write-Host "`n=== PortProxy registry persistence ===" -ForegroundColor Cyan
$pp = 'HKLM:\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4\tcp'
if (Test-Path $pp) { Get-ItemProperty $pp | Format-List } else { Write-Host 'None found.' }

Write-Host "`n=== Recent shadow copies (should match your backup schedule) ===" -ForegroundColor Cyan
Get-CimInstance Win32_ShadowCopy | Select-Object InstallDate, DeviceObject, VolumeName | Format-Table -AutoSize

Write-Host "`n=== Scheduled tasks not under Microsoft path (LOTL persistence check) ===" -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { $_.TaskPath -notlike '\Microsoft*' } |
  Select-Object TaskName, TaskPath, State | Format-Table -AutoSize

#!/bin/bash
# Edge-device proxy behavior triage — run against your perimeter segment
# 1. Identify devices with high symmetric outbound flows to rare destinations
sudo tcpdump -i any -nn -c 10000 'not net 10.0.0.0/8 and not net 172.16.0.0/12 and not net 192.168.0.0/16' \
  | awk '{print $3, $5}' | sort | uniq -c | sort -rn | head -30

# 2. On Linux-based appliances: check for unexpected listening proxies and tunnels
ss -tulnp | grep -Ev '(sshd|snmpd|ntpd|named)'
ip tunnel show; ip link show type wireguard 2>/dev/null

# 3. Audit admin access to edge gear — Volt Typhoon uses valid accounts post-exploit
last -F | head -50
grep -E 'Accepted|session opened' /var/log/auth.log | tail -100

# 4. Verify firmware currency against vendor advisory pages (manual step — see Remediation)
echo "Compare running firmware against vendor security advisories before rebooting anything."

Remediation

1. Patch or replace every internet-facing edge device now. Inventory all VPN gateways, firewalls, routers, and remote-site SOHO gear. Cross-reference firmware versions against vendor security advisories (Cisco Security Advisories, Fortinet PSIRT, Ivanti Security Advisories, NETGEAR security pages) and the CISA KEV catalog. End-of-life devices cannot be made safe — replace them. Volt Typhoon specifically favors EOL hardware precisely because it will never be patched.
2. Enforce CISA KEV deadlines as a floor, not a ceiling. Federal civilian agencies are bound to KEV remediation dates; private-sector organizations should adopt the same deadlines internally for edge infrastructure, and treat any KEV-listed flaw on an internet-facing device as an emergency change.
3. Disable and audit management interfaces on the WAN. No router or firewall management plane (web UI, SSH, Telnet, SNMP write) should be reachable from the internet. Where remote management is unavoidable, restrict by source IP and require MFA-backed access through a jump host.
4. Hunt for valid-account abuse. Volt Typhoon's defining behavior is using stolen credentials and native tools. Review authentication logs on edge devices for logins from unusual geographies or at unusual hours, rotate all administrative credentials on any device that was ever unpatched and internet-exposed, and enforce MFA everywhere it is supported.
5. Egress filtering and monitoring. Block outbound traffic from edge devices and servers to anything not required for updates and management. Alert on high-volume symmetric flows to rare external IPs (per the KQL above) — this is the single most reliable network-layer tell of your equipment being used as an ORB node.
6. Segment and monitor domain controllers and critical OT/IT junctions. Given Volt Typhoon's pre-positioning mission against critical infrastructure, ensure detection coverage (Sysmon or EDR) on domain controllers, alert on ntdsutil and shadow-copy activity, and verify backup integrity — assume credential theft has been attempted.
7. Engage threat intelligence on ORB infrastructure. Subscribe to Black Lotus Labs reporting and CISA joint advisories (AA24-038a and successors). If you identify a suspected relay node in your environment, report to CISA (report@cisa.gov) — attribution to campaigns like Silent Train depends on victim reporting.

The disruption of Silent Train removes infrastructure, not capability or intent. Volt Typhoon's recruitment pipeline is the global population of unpatched edge devices. Every device you patch or replace is one fewer car on the next train.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub