Six virtual hops: The new path Chinese hackers use to stay hidden

A team of cybersecurity analysts has identified a specific, repeatable method that a Chinese state-linked hacking group uses to infiltrate critical U.S. infrastructure.

The group, known as Volt Typhoon, has targeted government, defense, telecommunications, and critical infrastructure sectors for years. U.S. national security officials describe their goal as quietly gaining access to strategic targets. These targets include water systems, rail networks, and aviation. Analysts note that while these sites are useful for intelligence gathering, they also pose a physical risk. An adversary could shut off power or block access to ports, creating panic or slowing a military response in a conflict.

The hackers have recently adopted a stealthier approach that Lumen’s Black Lotus Labs has named Silent Train. Michael Horka, a principal information security analyst at Lumen, explained that the group creates a new, winding pathway for every intrusion. This path traverses up to six different virtual networks and compromised devices, such as routers. The attackers never retrace their steps. They also exploit previously undiscovered vulnerabilities and cover their tracks behind them. Horka stated that the group is purposely trying to stay extremely quiet.

Horka’s team tracks network traffic along the internet’s backbone. Lumen is a telecommunications company that helps route this traffic. Although hackers can hide some of their digital footprints, they cannot eliminate them entirely. Horka described the investigation as a wild goose chase at times. It involved a lot of thread pulling. Eventually, the team found a reproducible network pattern. They were able to create a signature for this pattern, which allows defenders to identify the group’s movements more easily.

The discovery highlights the high motivation and investment of these state actors. Horka suggests that defenders need to match that level of effort. He advises network defenders and threat hunters to think like attackers. If an asset is valuable to an organization, it is likely a target for these groups. Horka believes that exposing the trade craft of Volt Typhoon will make it harder for them to remain hidden. He compares the situation to dropping a rock into still pond water. He wants to see the ripples that follow.

The Silent Train tactic represents a shift in how the group operates. They have moved from simple intrusions to complex, multi-step pathways designed to evade detection. This requires defenders to monitor for specific sequences of network activity rather than just isolated breaches. The ability to signature this pattern gives security teams a concrete tool to track the group’s progress. Horka will continue to monitor for signs that the group is reacting to the new visibility.