Its report described at least four confirmed and one likely zero-day vulnerabilities exploited by Volt Typhoon, which targeted network and endpoint management systems, SD-WAN orchestrators and control plane infrastructure that provide visibility, administration and access across enterprise and customer environments. It noted that victims included telecommunications providers, government, defense contractors, satellite and mission-critical communication services, universities, IT firms and critical infrastructure such as water, energy, transportation, maritime, rail, aviation, emergency services and other essential operations.
Lumen said the nature of these victims “indicates deliberate efforts to maintain access to critical ecosystems that support defense, logistics, communications, military and civilian operations, especially during heightened tensions or crises in the Indo-Pacific region.”
Although the Silent Train attack has been in the wild for years and was tracked by various cybersecurity teams, the level of operational details that Lumen reported Wednesday went well beyond what had been known.
