China’s ‘Volt Typhoon’ quietly built another hacking network following US crackdown, new findings say

Research indicates that Chinese cyber threat actors, known as Volt Typhoon, have established a new, clandestine hacking network dubbed Silent Train, operating concurrently with previous operations despite US countermeasures. This campaign has spanned three years and targets critical U.S. sectors including government entities, defense contractors, telecommunications providers, universities, and infrastructure operators like Energy Department facilities. Initial disruption efforts focused on dismantling KV Botnet in late 2023 through law enforcement action. However, the emergence of Silent Train suggests a sustained persistence by the threat group, utilizing chains of compromised devices—such as routers and networking equipment—to maintain covert access across vital civilian and military systems.
The new network leverages enterprise IT management tools as high-value entry points, allowing hackers to bypass typical network traversal challenges by accessing already privileged administrative platforms. Attacks have concentrated in areas like Hawaii, California, and Texas, pointing toward strategic positioning for potential disruption against Indo-Pacific related defense and infrastructure networks. While US officials previously warned that dismantling old infrastructure would not stop the threat, these findings detail an active secondary operation showing significant operational resilience amidst government counter-insurgency efforts.

A three-year hacking campaign targeted government, defense, and critical infrastructure networks in the U.S.
The actor group is known as Volt Typhoon.
U.S. officials issued a warning in January 2024 regarding Chinese hackers embedding themselves in critical infrastructure targeting power grids and transportation.
The FBI struck a network of compromised routers called KV Botnet in December 2023, which was announced the following month.
Black Lotus Labs released findings detailing another operation named Silent Train on Wednesday.
Silent Train supports a three-year campaign against government systems, defense contractors, satellite services, and various critical infrastructure operators.
Energy Department facilities and utility providers have been affected over the last year.
The network relies on chains of compromised routers, corporate networking equipment, and internet-connected devices.
Hackers targeted entities in Hawaii, California, and Texas to position for Indo-Pacific disruption.
Telecom providers were reached via enterprise IT management tools offering broad administrative access.
Access windows for Silent Train averaged about four hours; hackers dismantled traces after operations.

The core tension here lies between visible counter-offensive action—the dismantling of KV Botnet—and the quiet, persistent continuation of adversary presence via Silent Train. This demonstrates a fundamental challenge in cyber defense: kinetic or structural disruption is insufficient against an adaptive, geographically distributed threat leveraging established trust vectors (like enterprise management platforms). The assumption being tested is that successful initial penetration can be permanently excised; this research suggests the counter-narrative that deep footholds are persistent and transferable across infrastructure.
The emphasis on targeting areas connected to the Indo-Pacific suggests a strategic projection of hostile capability, shifting the framing from mere espionage to pre-positioning for kinetic or catastrophic interference during geopolitical stress points. Furthermore, the sophistication—bypassing traditional network hopping by hitting privileged management tools directly—highlights an evolution in adversarial methodology that treats existing administrative access as a high-value exploit itself.
The unstated paradigm is the current limitations of deterrence theory in state-level cyber conflict; diplomatic warnings and network takedowns appear insufficient to alter deeply embedded, mission-oriented adversary postures. The dignity cost here is the potential erosion of foundational civilian infrastructure during a crisis, shifting national risk management from discrete event response to continuous existential threat mitigation.
What protocols exist within government agencies to rapidly identify when an apparent cleanup operation has inadvertently facilitated the creation or stabilization of a secondary, more advanced persistence mechanism? If access tools are leveraged across sectors (energy, telecom), what centralized monitoring architecture would be required to detect this cross-sectoral "low and slow" consolidation? How do national security frameworks weigh immediate network takedowns against the long-term strategic risk posed by hidden system presence?
Patterns detected: none