Volt Typhoon hides zero-day attacks using 'Silent Train' framework
Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems.
Excerpt from the primary source: BleepingComputer
Who is affected
Enterprises · Security professionals
Why it matters
There are signs this may already be exploited, which usually shortens the time available to patch.
Automated: stated only from CISA listings and the exploitation evidence in the sources below.
What you should do · Review
Review whether your organization uses the affected products and assess exposure using the linked advisories.
Automated guidance based on this story's classification. Check the linked advisories for specifics.
Sources
We link to original and authoritative sources. Headlines and excerpts belong to their publishers.
Original reporting
Related
US sanctions Russians, North Koreans for laundering IT worker earnings
The U.S. Treasury Department sanctioned Russian and North Korean nationals for allegedly laundering the earnings of illicit IT workers on behalf of Pyongyang.
Studying Fraudulent North Korean IT Workers
Researchers set up a fake start-up company to study fraudulent North Korean IT workers.
China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
The state-sponsored hackers targeted hundreds of organizations and gained privileged access to some environments.
Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016
After a three-month lull, Prince of Persia hid a Tornado C&C server on US shared hosting, its first US-based server since 2016.