Chinese state-sponsored hacking group Volt Typhoon has been using a framework dubbed Silent Train, which rotates chains of compromised devices to hide attacks that have exploited at least four zero-day vulnerabilities against high-value targets, according to researchers at Black Lotus Labs, the threat research division of communications company Lumen.
Black Lotus Labs has tracked Silent Train for three years and said Volt Typhoon exploited at least four zero-day vulnerabilities in attacks on edge and management infrastructure. The affected products include VeloCloud Orchestrator, Cisco Catalyst SD-WAN, N-able N-central and Versa Director, with Quest KACE suspected as an additional zero-day target.
The researchers said Silent Train is a relay infrastructure formed of compromised devices. Operators route activity through VPS infrastructure outside the United States, then pass it through hacked devices such as routers before launching attacks. Intelbras modems served as overseas relays, while Netgear Orbi devices acted as hops in the U.S.
Victims include telecommunication firms, government agencies, defense contractors, educational institutes, utilities and critical infrastructure, satellite service providers, IT firms, managed service providers, transportation, aviation and emergency services. The most targeted regions were California, Texas and Hawaii, suggesting a focus on Indo-Pacific matters.
"To construct these sessions, its operators exploit exposed web interfaces on SOHO, IoT, and other relay devices, then deploy only the tooling needed to enable chained SSH access through the compromised node," Black Lotus Labs explains in a report. "This included temporary SSH services, keys, configuration files, and 'live off the land' utilities."
After each session, typically ending in under 8 hours, the threat actors remove all tooling, keys and configuration files from the disposable relays. By early 2025, the framework became hybrid, using disposable relays alongside compromised enterprise systems retained for between one and three months.
The researchers said Silent Train's deployment was partly fueled by the FBI's disruption of KV-Botnet, a botnet Volt Typhoon previously used to evade detection when attacking U.S. critical infrastructure. CISA has warned the group seeks to establish access for potential disruption during a future crisis or conflict.
Black Lotus Labs recommends strengthening security around centralized management systems, restricting internet access to administrative interfaces, rapidly patching vulnerabilities, and centralizing logs with longer retention. It also advises monitoring for unusual administrative activity and reviewing trusted connections that could expose customer or partner networks.
Analysis
Why This Matters
- Zero-day exploits against centralized management platforms give attackers broad administrative control, enabling credential theft, remote access and reach into downstream customers without the noisy lateral movement that might trigger detection.
- The campaign targets critical infrastructure, government agencies and defense contractors, and CISA has previously warned Volt Typhoon seeks to establish access for potential disruption during a future crisis or conflict.
- Silent Train's design, disposable relays cleaned within hours, makes attacks harder to attribute and detect, raising the stakes for defenders managing edge and management systems.
Background
Volt Typhoon is a Chinese state-sponsored hacking group that previously targeted U.S. critical infrastructure, including communications, energy, transportation and water systems. Black Lotus Labs has been tracking Silent Train for three years. The framework emerged partly after the FBI disrupted KV-Botnet, which Volt Typhoon had used for evasion. Operators compromise exposed web interfaces on SOHO routers, IoT devices and other relays, then deploy only the tooling needed for chained SSH access through each node. By early 2025, the framework mixed disposable relays with enterprise systems retained for up to three months.
What to Watch
- Whether the suspected Quest KACE zero-day is formally confirmed and patched.
- Whether Silent Train activity expands beyond the most-targeted regions of California, Texas and Hawaii.
- Whether organizations follow CISA and NCSC guidance on Volt Typhoon, particularly around restricting access to administrative interfaces and patching centralized management systems.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedBlack Lotus Labs said Volt Typhoon exploited at least four zero-day vulnerabilities in attacks on edge and management infrastructure.BleepingComputer: “Researchers at Black Lotus Labs, the threat research division of communications company Lumen, have been tracking Silent Train for three years and confirmed that Volt Typhoon exploited at least four zero-day vulnerabilities in attacks targeting edge and management infrastructure.”
- SupportedThe first quoted description of how operators construct sessions is attributed to Black Lotus Labs.BleepingComputer: ““To construct these sessions, its operators exploit exposed web interfaces on SOHO, IoT, and other relay devices, then deploy only the tooling needed to enable chained SSH access through the compromised node,” Black Lotus Labs explains in a report today.”
- SupportedThe second quoted description lists temporary SSH services, keys, configuration files and “live off the land” utilities.BleepingComputer: ““This included temporary SSH services, keys, configuration files, and “live off the land” utilities.””
- SupportedVolt Typhoon has been using a framework dubbed Silent Train, which rotates chains of compromised devices to hide attacks on high-value targets.BleepingComputer: “Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems. The framework has been dubbed Silent Train”
- SupportedThe affected products include VeloCloud Orchestrator, Cisco Catalyst SD-WAN, N-able N-central and Versa Director; Quest KACE is a suspected additional zero-day target.BleepingComputer: “CVE-2026-16812 – VeloCloudOrchestrator CVE-2026-20127 – Cisco Catalyst SD-WAN CVE-2025-8875 and CVE-2025-8876 – N-able N-central CVE-2024-39717 – Versa Director Quest KACE (suspected zero-day)”
- SupportedOperators route activity through VPS infrastructure outside the United States, then through compromised devices such as routers before launching attacks.BleepingComputer: “The operators route their activity through VPS infrastructure outside the United States, then pass it through hacked devices such as routers that act as intermediate relays before launching attacks.”
- SupportedIntelbras modems served as overseas relays and Netgear Orbi devices acted as hops in the United States.BleepingComputer: “Black Lotus Labs says Intelbras modems served as overseas relays, while Netgear Orbi devices acted as hops in the U.S.”
- SupportedThe most targeted regions were California, Texas and Hawaii, suggesting a focus on Indo-Pacific matters.BleepingComputer: “Black Lotus Labs’ observations indicate the most targeted regions are California, Texas, and Hawaii, suggesting a focus on Indo-Pacific matters.”
- SupportedSessions typically ended in under eight hours, after which operators removed tooling, keys and configuration files from disposable relays.BleepingComputer: “After the session ends, typically in under 8 hours, the threat actors remove all their tooling, keys, and configuration files from the disposable relays.”
- SupportedBy early 2025, the framework used disposable relays alongside compromised enterprise systems retained for between one and three months.BleepingComputer: “By early 2025, researchers noticed that the framework become hybrid, using disposable relays alongside compromised enterprise systems thaat were retained between one and three months.”
- SupportedResearchers said Silent Train’s deployment was partly fueled by the FBI’s disruption of KV-Botnet, which Volt Typhoon had used to evade detection when attacking U.S. critical infrastructure.BleepingComputer: “According to the researchers, Silent Train's deployment was partly fueled by the FBI's disruption of KV-Botnet , a botnet that Volt Typhoon used to evade detection when attacking critical infrastructure in the US.”
- SupportedCISA warned that Volt Typhoon seeks access for potential disruption during a future crisis or conflict.BleepingComputer: “with CISA warning that it seeks to establish access for potential disruption during a future crisis or conflict.”
