Volt Typhoon-linked attacks leave US critical infrastructure compromised long term

China-linked hacking group Volt Typhoon exploited at least four zero-day vulnerabilities to maintain prolonged access to US government agencies and critical infrastructure across telecommunications, defence, energy and other sectors. The attackers concealed their attack routes using compromised routers and Internet of Things devices and seized control of central management systems to obtain internal access privileges. In breaches affecting US telecommunications operators, government agencies, defence contractors and satellite communications operators, a Cisco SD-WAN zero-day and KeyDrift malware were used to steal encryption keys and sustain access, with analysis identifying substantial overlap between the attack infrastructure and Volt Typhoon’s Silent Train network.