A China-linked cyber espionage group known as Volt Typhoon deployed a covert access network called Silent Train to exploit zero-day vulnerabilities and maintain strategic access to critical U.S. systems, according to a new report from Lumen Technologies Black Lotus Labs. First detected in late 2023, the network used rotating chains of compromised home routers, internet-connected devices, and enterprise infrastructure to carry out attacks while employing cleanup techniques designed to erase forensic traces. The network enabled the group to conduct vulnerability exploitation, steal credentials, extract data, and sustain long-term access to victim environments.
Black Lotus Labs identified hundreds of victims across telecommunications companies, government agencies, defense contractors, satellite services, universities, IT firms, and critical infrastructure including water, energy, transportation, maritime, rail, aviation, and emergency services. The threat actor conducted at least four confirmed zero-day campaigns through Silent Train, exploiting flaws in Versa Director (CVE-2024-39717), N-able N-central (CVE-2025-8875 and CVE-2025-8876), Cisco Catalyst SD-WAN Controller (CVE-2026-20127), and Arista VeloCloud Orchestrator (CVE-2026-16812). Volt Typhoon is also suspected of leveraging a likely zero-day in Quest KACE before it was patched in October 2025, affecting more than 30 victims. The group targeted endpoint management platforms, network management systems, SD-WAN orchestrators, and control plane technologies that could provide scalable access to downstream customers, sensitive networks, or strategic programs. At least 27 device classes—ranging from home routers made by TP-Link, Intelbras, NETGEAR, Zyxel, and Cambium to enterprise platforms from Fortinet, Cisco, PRTG, Mirth Connect, and CyberPanel—were exploited and enrolled into the covert network.
"Silent Train is built around rapidly rotating chains of compromised SOHO, IoT, and enterprise devices that are exploited on demand, used against carefully selected targets, cleaned up after each operation, and continuously refreshed," the report states. The network operated as a layered, multi-hop framework that relayed malicious traffic through several devices before reaching targets, obscuring its origins from both victims and defenders. Sessions began from virtual private servers located outside the U.S., then passed through compromised non-U.S. home routers and internet-connected devices across different countries before exiting through U.S.-based compromised devices that helped evade geofencing and IP reputation blocklists. Operators exploited exposed web interfaces on relay devices, deployed only the tools needed to enable chained SSH access, then removed every artifact and dismantled the operational chain at the end of each session. Sessions lasted about four hours on average, with some running only minutes. Certain device types were assigned specific positions within Silent Train—Intelbras modems appeared only as relay nodes, while Netgear Orbi and Fortinet FortiGate appliances served as U.S.-based intermediary and exit points interacting with victims.
Silent Train's operational activity surged after law enforcement disrupted KV-botnet—an IoT botnet linked to multiple China-nexus state-sponsored threat actors including Volt Typhoon—in late January 2024, prompting a shift to ephemeral infrastructure comprising diverse device types across geographies. Rather than continue using persistent infrastructure, Volt Typhoon shifted to a model using one-time-use chains of compromised devices that could be rebuilt as needed, creating what the report describes as a resilient, secure, and compartmentalized framework. By early 2025, Silent Train evolved from a completely ephemeral relay network to a hybrid architecture that retained enterprise-grade devices for an average of one to three months instead of changing them after each engagement, and introduced reverse-tunnel variants using open-source proxies like Chisel and FRP to send traffic from infected devices to upstream infrastructure. Within the U.S., Hawaii, California, and Texas emerged as focus areas, which the report attributes to these states hosting major military installations, telecommunications infrastructure, defense contractors, satellite communications providers, and critical logistics networks.
The report concludes that "victimology indicates deliberate efforts to maintain access to critical ecosystems that support defense, logistics, communications, military and civilian operations, especially during heightened tensions or crises in the Indo-Pacific region." Through repeated targeting of centralized management platforms and control plane technologies, Silent Train demonstrates how Volt Typhoon systematically pursues and preserves access to some of the most consequential networks in the United States. The resulting picture is one of a highly structured framework built to acquire, protect, and sustain strategic access at scale. Organizations that manage endpoint systems, network orchestration, or SD-WAN infrastructure face elevated risk from threat actors seeking not just data but persistent visibility and control across entire enterprise environments. The shift from disposable botnet relays to carefully curated device chains signals a maturation in tradecraft that rewards patient operators willing to invest in operational security over speed.