Volt Typhoon-linked attacks compromise US critical infrastructure over extended periods

China-linked hacking group Volt Typhoon exploited at least four zero-day vulnerabilities to maintain long-term access to US government agencies and critical infrastructure in sectors including telecommunications, defense, and energy. The attackers concealed their attack routes through compromised routers and Internet of Things devices and took control of central management systems to gain internal access privileges. In breaches targeting US telecommunications carriers, government agencies, defense contractors, and satellite communications operators, a Cisco SD-WAN zero-day and KeyDrift malware were used to steal encryption keys and maintain persistent access, while analysis found substantial overlap between the attack infrastructure and Volt Typhoon’s Silent Train network.