Volt Typhoon used Silent Train relays to hide zero-day exploits

Chinese state-sponsored group Volt Typhoon operated a rotating relay framework called Silent Train to conceal attacks on high-value systems, Black Lotus Labs, Lumen's threat research division, said in a report. The researchers said they tracked Silent Train for three years and confirmed the group exploited at least four zero-day flaws across edge and management infrastructure.

The zero-day activity included flaws in VeloCloud Orchestrator (CVE-2026-16812), Cisco Catalyst SD-WAN (CVE-2026-20127), N-able N-central (CVE-2025-8875 and CVE-2025-8876), and Versa Director (CVE-2024-39717). Black Lotus Labs also listed Quest KACE as a suspected zero-day target.

The compromised platforms provided wide-reaching control over administration, enabling credential theft, remote access, and movement into downstream customers without the noisy lateral movement that could trigger alerts. Targets included telecommunication companies, government agencies, defense contractors, schools, utilities and critical infrastructure, satellite providers, IT companies, managed service providers, transport, aviation, and emergency services. California, Texas, and Hawaii were the most targeted regions, which Black Lotus Labs said suggests a focus on Indo-Pacific matters.

Silent Train worked as a relay chain. Operators first routed traffic through virtual private servers located outside the United States, then pushed it through hacked devices such as routers that served as intermediate relays before launching attacks. Overseas relays included Intelbras modems, and Netgear Orbi devices functioned as hops inside the U.S.. "To construct these sessions, its operators exploit exposed web interfaces on SOHO, IoT, and other relay devices, then deploy only the tooling needed to enable chained SSH access through the compromised node," the researchers wrote. Sessions typically ended in under eight hours, after which operators stripped the disposable relays of all tools, keys, and configuration files. By early 2025, the framework became hybrid, combining disposable relays with compromised enterprise systems kept for one to three months.

The researchers assessed that Silent Train was kept for high-value targets and careful, hands-on operations in the China Standard Time timezone. The FBI's earlier disruption of KV-Botnet, a botnet Volt Typhoon used to avoid detection when attacking U.S. critical infrastructure, partly fueled Silent Train's deployment, according to Black Lotus Labs. CISA has previously warned that Volt Typhoon seeks access to communications, energy, transportation, and water systems to enable possible disruption in a future crisis or conflict.

Black Lotus Labs recommends limiting internet exposure of administrative interfaces, applying patches quickly, keeping logs longer and centralized, watching for unusual administrative activity, and examining trusted links that might expose customer or partner networks. It also pointed to CISA and NCSC guidance on Volt Typhoon.