The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been put to use for zero-day exploitation and strategic access.
“First identified in late 2023, Silent Train uses rotating chains of compromised SOHO, IoT, and enterprise infrastructure,” Lumen Technologies Black Lotus Labs said in a report shared with The Hacker News. “It employs anti-forensic techniques, compartmentalized operations, and post-operation cleanup to minimize detection and attribution.”
Its main purpose is to facilitate critical attack phases like vulnerability exploitation, credential access, data exfiltration, and to maintain continued access to victim environments. The activity stands out for two main reasons –
- It singled out entities that could provide scalable access to downstream customers, sensitive networks, or strategic programs.
- It targeted endpoint management platforms, network management systems, SD-WAN orchestrators, and control plane technologies that play a crucial role within enterprise environments.
Hundreds of victims have been identified across telecommunications providers, government, defense contractors, satellite and mission-critical communication services, universities, IT firms, and critical infrastructure such as water, energy, transportation, maritime, rail, aviation, and emergency services.
Volt Typhoon (aka Bronze Silhouette, Insidious Taurus, UNC3236, Vanguard Panda, and Voltzite) is the moniker assigned to a China-linked state-sponsored group known for its targeting of critical infrastructure networks, particularly communications, energy, transportation, and water and wastewater systems sectors.
Known to be active since at least 2021, the threat actor was previously observed exploiting a file upload vulnerability in Versa Director as a zero-day (CVE-2024-39717) to deliver a bespoke web shell called VersaMem designed to harvest credentials and enable access to downstream customers.
The latest findings from Black Lotus Labs show that the security flaw was one among four confirmed zero-day campaigns the threat actor has conducted through Silent Train. The remaining three vulnerabilities are listed below –
- CVE-2025-8875 and CVE-2025-8876 – A set of insecure deserialization and command injection vulnerabilities in N-able N-central.
- CVE-2026-20127 – An authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller
- CVE-2026-16812 – An operating system command injection vulnerability in Arista VeloCloud Orchestrator
Separately, Volt Typhoon is also suspected to have taken advantage of a likely zero-day vulnerability in Quest KACE before it was patched in October 2025. The campaign is estimated to have impacted more than 30 victims.
“Silent Train is built around rapidly rotating chains of compromised SOHO, IoT, and enterprise devices that are exploited on demand, used against carefully selected targets, cleaned up after each operation, and continuously refreshed,” Black Lotus Labs said.
“This model has enabled Volt Typhoon to conduct exploitation and post-exploitation operations with exceptional operational security while minimizing opportunities for detection, attribution, and disruption.”
A defining characteristic of these attacks is the repeated targeting of systems that can open the door to broad visibility, control, and access across large enterprise environments of strategic value to the U.S.
What’s interesting is that the covert access capability began to take shape sometime around November 2023, just weeks before the first round of disruption targeting KV-botnet, an IoT botnet linked to multiple China-nexus state-sponsored threat actors, including Volt Typhoon.
Silent Train’s operational activity is said to have surged in the wake of the botnet’s second disruption in late January 2024, while simultaneously shifting to an ephemeral infrastructure comprising diverse device types and across geographies.
“Rather than continue using persistent infrastructure, Volt Typhoon shifted to a model using one-time-use chains of compromised devices that it could rebuild as needed,” Black Lotus Labs said. “Volt Typhoon rapidly assembled and dismantled transient infrastructure, creating a resilient, secure, and compartmentalized framework that protected valuable access.”
Described as a “layered, multi-hop framework,” Silent Train is designed to let Volt Typhoon operators relay malicious traffic through several devices before it reaches the targets so as to obscure its origins from both victims and defenders. Each link in the chain serves a specific purpose –
- Virtual private servers (VPS) that function as a temporary staging area and allow threat actors to provision and discard them after each session. The sessions begin from VPS infrastructure located outside the U.S.
- Compromised non-U.S. SOHO and IoT devices located across different countries, providers, and hardware that conceal the starting point of the attack.
- U.S.-based compromised devices that function as an exit node before reaching the domestic victim and help evade geofencing and IP reputation blocklists.
No less than 27 device classes, ranging from SOHO and IoT devices (e.g., TP-Link, Intelbras, Ruckus Wireless, SATO, NETGEAR, Zyxel, and Cambium) to enterprise platforms (e.g., Fortinet, Cisco, PRTG, Mirth Connect, and CyberPanel), have been exploited and enrolled into the covert network.
“Silent Train stands out for its operational discipline, focusing on short-lived, selfmanaged sessions rather than persistent relays or C2 infrastructure,” Black Lotus Labs said. “To construct these sessions, its operators exploit exposed web interfaces on SOHO, IoT, and other relay devices, then deploy only the tooling needed to enable chained SSH access through the compromised node.”
“This included temporary SSH services, keys, configuration files, and ‘live off the land’ utilities. At the end of operational sessions, they removed every artifact and dismantled the operational chain in their wake. Silent Train sessions lasted about four hours on average, with some lasting only minutes.”
Another notable aspect is the designation of certain device types to specific positions within Silent Train. For instance, Intelbras modems have been found to only appear as relay nodes, while Netgear Orbi and Fortinet FortiGate appliances served as U.S.-based intermediary and exit points responsible for interacting with the victim.
Put differently, the infrastructure points to deliberate compartmentalization across layers, confining some device types to certain roles that remain constant while the underlying infrastructure itself changes over time so as to complicate attribution efforts.
By early 2025, however, Silent Train is believed to have evolved from a completely ephemeral relay network to a hybrid architecture that retained enterprise-grade devices for an average of one to three months instead of changing them after each engagement.
Subsequent maturation of the platform introduced reverse-tunnel variants that used open-source proxies like Chisel and FRP to send traffic from infected devices to upstream infrastructure.
Within the U.S., Hawaii, California, and Texas have emerged as the focus areas of Silent Train operations, which boils down to the fact that these states host major military installations, telecommunications infrastructure, defense contractors, satellite communications providers, and critical logistics networks.
“Victimology indicates deliberate efforts to maintain access to critical ecosystems that support defense, logistics, communications, military and civilian operations, especially during heightened tensions or crises in the Indo-Pacific region,” Black Lotus Labs said.
“The resulting picture is one of a highly structured framework built to acquire, protect, and sustain strategic access at scale. Through repeated targeting of centralized management platforms and control plane technologies, Silent Train shows how Volt Typhoon systematically pursues and preserves access to some of the most consequential networks in the United States.”
