China Built a Secret Hacking Network Out of Americans' Home Routers. The FBI Keeps Cutting It Down. It Keeps Coming Back.
Two FBI seizures in two months, and now a new report says China-linked hackers spent three years sneaking into U.S. government, phone, defense and utility networks. Officials have long warned what it's for: switching off America in a war over Taiwan.
See where this is ›WASHINGTON —
The internet router sitting on a shelf in an American home may have been working for China.
That is the picture from a report released Wednesday, Oct. 28, by Black Lotus Labs, the research team at the internet company Lumen. It found that Volt Typhoon, a hacking group U.S. officials tie to the Chinese government, built a hidden network out of hijacked home routers, small-office equipment and business firewalls, and used it for three years to slip into American networks without being traced. Lumen calls it “Silent Train.”
It is the latest round in a fight most Americans never see. On Aug. 26, the FBI seized tools that a Chinese firm used to target NASA, the Federal Reserve and the U.S. Senate. On Oct. 8 it seized seven more web domains run by a Beijing company. And now Silent Train shows that while the FBI was taking apart the hackers' last network, they were quietly building a new one.
What "Silent Train" did
Lumen says the network was used against U.S. government agencies, defense contractors, phone and internet companies, satellite services, universities with military ties, and water, energy and transportation operators. It counted more than 27 kinds of hijacked devices, including TP-Link and Netgear home routers and Fortinet business firewalls.
The trick is to look local. An attack starts with the operators, hops through hacked modems overseas, then through hacked routers inside the United States, so the break-in looks like it came from an ordinary American home or office. Each chain was used for about four hours on average and then torn down and wiped.
The group also broke in through at least four “zero-day” flaws, holes the software makers did not know about yet, in network-control systems sold by Cisco, N-able, Arista VeloCloud and Versa. Those systems manage whole networks at once, which is why the hackers wanted them. The companies have since released fixes. Lumen says it sent “hundreds” of warnings to victims and wrote that the hackers “occupied positions of trust and connectivity upon which military, government, and civilian operations depend.”
Why Hawaii, California and Texas
Those three states were targeted most. Lumen believes that reflects an effort to be in position to disrupt U.S. defense and infrastructure networks tied to the Pacific, Nextgov/FCW reported. Hawaii is home to U.S. Indo-Pacific Command, the military headquarters that would lead any fight over Taiwan. Nextgov also reported, citing unnamed sources, that Energy Department sites and several utility companies dealt with Volt Typhoon activity in the past year.
The FBI keeps cutting the wires
In December 2023, the FBI wiped out Volt Typhoon's first router network. A month later, then-FBI Director Christopher Wray told a House committee that Chinese hackers were positioning themselves to “wreak havoc and cause real-world harm to American citizens,” and officials said the goal was to slow the U.S. military if war came over Taiwan. Paul Abbate, then the FBI's deputy director, admitted months later that the takedowns “just has not had the deterrent effect that we would want to see.”
The seizures have not let up. On Aug. 26 the FBI seized three domains used by a Nanjing company that prosecutors say sold hacking services to China's intelligence agency and military. The Justice Department later corrected its announcement to say agencies like NASA and the Senate were targeted, and only some were actually broken into.
On Oct. 8 the FBI seized seven domains run by Integrity Technology Group, a Beijing firm the FBI says works for the Chinese government and is the group known as Flax Typhoon. Its tools, “Microscan” and “FishHub,” went after an unnamed U.S. power company, airports in Japan and Poland, and Taiwanese universities and infrastructure, the Associated Press reported. FBI official Jason Bilnoski called the hacking “indiscriminate and reckless.”
A separate group, Salt Typhoon, broke into AT&T, Verizon and other phone and internet carriers. The FBI says it has hit at least 200 companies and has offered up to $10 million for information about it. And on Oct. 28, the government's cyber-defense agency, CISA, warned that a China-linked group called Warp Panda used a hidden VMware server flaw against U.S. law firms. Federal agencies must patch it by Nov. 11.
What China says
China denies all of it. After the Oct. 8 seizures, Foreign Ministry spokesperson Mao Ning said China opposes “spreading disinformation for political purposes” and added, “We urge the U.S. to abandon its double standards and political manipulation.”
What to expect
No blackout or outage has been tied to these findings. The danger officials keep pointing to is quieter: access that is already in place and could be used later, in a crisis. That is why CISA in May launched a program called CI Fortify, asking power, water and other utilities to plan to keep running for “weeks to months” while cut off from the internet and outside vendors.
Expect more of the same pattern: another takedown, another report, another network found. Each time the FBI cuts one down, investigators have found the hackers already building the next. Lumen is urging companies to lock down and quickly patch the systems that control their networks.
Protect your home and church network
The devices these networks are built from are the same ones in homes, churches and small businesses. Five simple steps make yours a harder target.
Check your router tonight
- 1Find its ageLook up your router's model. If the maker no longer sends updates for it, replace it. Old routers are the ones these networks hijack.
- 2Update itInstall the latest software from the maker's app or website, and turn on automatic updates if it has them.
- 3Change the passwordReplace the factory admin password with a long one of your own.
- 4Turn off remote managementUnless you need it, switch off the setting that lets the router be controlled from the internet.
- 5Restart itReboot it now and then. Some router malware lives only in memory and is cleared by a restart.
