Lumen tracks China-linked Volt Typhoon relay network used to conceal zero-day exploits

Key points

• Lumen's Black Lotus Labs followed the infrastructure for roughly three years.
• Investigators linked the network to Volt Typhoon, a China-linked APT.
• The activity involved four zero-day flaws and attacks on critical systems.
• Operators used temporary relay hops to obscure their path.
• No CVE identifiers were published for the vulnerabilities.

For about three years, Black Lotus Labs at Lumen has tracked a hidden relay network that it now links to Volt Typhoon, an intrusion group widely said to be connected to China. Security Affairs highlighted the research, which describes how the infrastructure was used to mask attacks against critical systems.

According to the findings, the operators routed activity through disposable relay chains, making it harder for defenders to follow connections back to the intrusion group. The same infrastructure reportedly helped conceal zero-day attacks, including a set of four zero-day flaws that lacked CVE identifiers. No CVE IDs were assigned, limiting the usual patch-tracking shortcuts for defenders.

The targeting focused on critical systems, a category that in K-12 and government environments includes identity, network, and operational platforms whose compromise can disrupt essential services. The use of hidden relay paths complicates attribution and incident response, because logs may show only intermediary hops rather than the true source.

The three-year window suggests persistence rather than a short burst, and the link to a China-linked APT raises the stakes for agencies that already face state-sponsored espionage. Because no CVE identifiers are available, defenders cannot rely on standard vulnerability feeds to prioritize exposure; they must look for behavioral indicators and unusual relay traffic.

Watch for updates from Lumen and Black Lotus Labs, additional technical indicators from Security Affairs coverage, and any guidance that clarifies how the relay network was detected. Organizations should also monitor for anomalous outbound connections and unexpected intermediary infrastructure.

What to do now

1. Treat this as an active threat hunt: pull Lumen, Black Lotus Labs, and Security Affairs indicators, then search egress and proxy logs for unexpected relay hops and long-lived outbound sessions.
2. Map and reduce internet-exposed services on critical systems; close unused ports, retire unsupported appliances, and require VPN or zero-trust access for administrative interfaces.
3. Since no CVE IDs exist, compensate with hardening: enforce least privilege, disable unnecessary remote services, apply vendor mitigations, and block known-bad infrastructure at egress.
4. Deploy or tighten egress filtering and DNS allowlisting to disrupt disposable relay chains; alert on new external destinations from servers that should not initiate outbound traffic.
5. Strengthen identity controls for privileged accounts: phishing-resistant MFA, just-in-time access, and review of service accounts for lateral movement.
6. Enable centralized logging with sufficient retention and forward logs to a SIEM; investigate gaps around intermediary hops and unusual authentication patterns.
7. Coordinate with security operations and state or federal partners; brief leadership on the China-linked APT risk and rehearse containment for critical-system compromise.

Original source

Security Affairs