Volt Typhoon, a Chinese state-sponsored hacking operation, has deployed a sophisticated framework that strings together chains of compromised devices to conceal the source of its attacks, including assaults leveraging previously unknown vulnerabilities. Researchers at Black Lotus Labs, Lumen's threat intelligence arm, have identified this infrastructure as Silent Train, named for the group's practice of targeting specific victims, erasing its tools after each engagement, and continuously rebuilding the framework.
Black Lotus Labs has monitored Silent Train activity for three years and documented Volt Typhoon's exploitation of at least four zero-day vulnerabilities in operations targeting edge and management systems. The campaign has affected telecommunications companies, government bodies, defense firms, schools, utilities, critical infrastructure operators, satellite providers, technology companies, managed service providers, transportation operators, aviation firms, and emergency response agencies. Analysis suggests California, Texas, and Hawaii have been the most heavily targeted regions, pointing toward a strategic focus on Indo-Pacific interests.
Volt Typhoon's prior campaigns against U.S. critical infrastructure—including communications networks, power grids, transportation systems, and water utilities—prompted CISA to warn that the group aims to establish footholds for potential disruption during future crises or military conflicts. The emergence of Silent Train followed the FBI's takedown of KV-Botnet, a botnet that Volt Typhoon had relied upon to mask its activities while targeting American critical infrastructure.
Silent Train relay network
Silent Train functions as a relay network constructed from compromised devices that Volt Typhoon leverages to obscure the origin of its operations. The group channels its traffic through VPS infrastructure located outside the United States, then bounces it through hacked devices—primarily routers—that serve as intermediate hops before launching the actual attack. Black Lotus Labs identified Intelbras modems functioning as overseas relays and Netgear Orbi devices serving as U.S.-based hops in the chain.
Silent Train deployment involves exploiting security flaws, acquiring valid credentials, stealing data, and establishing durable remote access to targeted systems. Through tracking this activity, researchers documented zero-day exploitation affecting multiple platforms:
- CVE-2026-16812 – VeloCloudOrchestrator
- CVE-2026-20127 – Cisco Catalyst SD-WAN
- CVE-2025-8875 and CVE-2025-8876 – N-able N-central
- CVE-2024-39717 – Versa Director
- Quest KACE (suspected zero-day)
Compromising these management platforms grants attackers extensive administrative privileges, allowing them to harvest credentials, obtain remote access, and penetrate downstream customer networks while avoiding the detectable lateral movement that typically raises alarms.
To construct these sessions, its operators exploit exposed web interfaces on SOHO, IoT, and other relay devices, then deploy only the tooling needed to enable chained SSH access through the compromised node. This included temporary SSH services, keys, configuration files, and "live off the land" utilities.
Black Lotus Labs
Once an operational session concludes—typically lasting under 8 hours—the attackers systematically remove all deployed tools, keys, and configuration files from the temporary relays. By early 2025, the framework had evolved into a hybrid model combining disposable relays with compromised enterprise systems maintained for one to three months between operations.
Black Lotus Labs assesses that Silent Train targets only high-value victims and involves deliberate, hands-on operations timed to China Standard Time working hours. The deployment of zero-day exploits against these targets reinforces this assessment of selective, resource-intensive targeting.
Defensive recommendations
Researchers recommend organizations strengthen protections around centralized management systems, limit internet-facing access to administrative interfaces, apply patches rapidly when vulnerabilities are disclosed, and implement centralized logging with extended retention periods. Additional measures include heightened monitoring for anomalous administrative activity, auditing of trusted connections that could expose customer or partner infrastructure, and adherence to guidance issued by CISA and NCSC regarding Volt Typhoon threats.