Volt Typhoon hides zero-day attacks using 'Silent Train' framework

Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems.

The framework has been dubbed Silent Train because the threat actor uses it against select targets, cleans it up after each operation, and refreshes it continuously.

Researchers at Black Lotus Labs, the threat research division of communications company Lumen, have been tracking Silent Train for three years and confirmed that Volt Typhoon exploited at least four zero-day vulnerabilities in attacks targeting edge and management infrastructure.

Targets include telecommunication firms, government agencies, defense contractors, educational institutes, utilities/critical infrastructure, satellite service providers, IT firms, MSPs, transportation, aviation, and emergency services.

Black Lotus Labs’ observations indicate the most targeted regions are California, Texas, and Hawaii, suggesting a focus on Indo-Pacific matters.

Victims map
Source: Black Lotus Labs

Volt Typhoon previously targeted U.S. critical infrastructure, including communications, energy, transportation, and water systems, with CISA warning that it seeks to establish access for potential disruption during a future crisis or conflict.

According to the researchers, Silent Train's deployment was partly fueled by the FBI's disruption of KV-Botnet, a botnet that Volt Typhoon used to evade detection when attacking critical infrastructure in the US.

Activity comparison over time
Source: Black Lotus Labs

Silent Train relay network

Silent Train is practically a relay infrastructure formed of compromised devices that Volt Typhoon uses to hide the origin of its attacks.

The operators route their activity through VPS infrastructure outside the United States, then pass it through hacked devices such as routers that act as intermediate relays before launching attacks.

Black Lotus Labs says Intelbras modems served as overseas relays, while Netgear Orbi devices acted as hops in the U.S.

Silent Train attack overview
Source: Black Lotus Labs

The threat actor's use of Silent Train involves exploiting vulnerabilities, stealing credentials, exfiltrating data, and maintaining persistent remote access to compromised systems.

By monitoring Silent Train activity, the researchers were able to observe zero-day exploits for the following products:

• CVE-2026-16812 – VeloCloudOrchestrator
• CVE-2026-20127 – Cisco Catalyst SD-WAN
• CVE-2025-8875 and CVE-2025-8876 – N-able N-central
• CVE-2024-39717 – Versa Director
• Quest KACE (suspected zero-day)

Compromising these platforms gives threat actors broad administrative control, enabling credential theft, remote access, and reach into downstream customers without the “noisy” lateral movement that might trigger detection.

Exploitation timeline
Source: Black Lotus Labs

“To construct these sessions, its operators exploit exposed web interfaces on SOHO, IoT, and other relay devices, then deploy only the tooling needed to enable chained SSH access through the compromised node,” Black Lotus Labs explains in a report today.

“This included temporary SSH services, keys, configuration files, and “live off the land” utilities.”

After the session ends, typically in under 8 hours, the threat actors remove all their tooling, keys, and configuration files from the disposable relays.

By early 2025, researchers noticed that the framework become hybrid, using disposable relays alongside compromised enterprise systems thaat were retained between one and three months.

Black Lotus Labs believes Silent Train was reserved for high-value targets and careful, hands-on operations conducted on China Standard Time (CST) timezone. The use of zero-days against those targets further strengthens the assumption.

The researchers recommend strengthening security around centralized management systems, restricting internet access to administrative interfaces, rapidly patching vulnerabilities, and centralizing logs with longer retention.

They also advise monitoring for unusual administrative activity, reviewing trusted connections that could expose customer or partner networks, and following CISA and NCSC guidance on Volt Typhoon.