Volt Typhoon Ran Four Zero-Day Campaigns Through the Covert Silent Train Network

Researchers at Lumen Technologies' Black Lotus Labs have published a report on Silent Train, a covert access network they attribute to the China-nexus espionage group Volt Typhoon. The network has since been disrupted. According to the researchers, Silent Train was first spotted in late 2023. It was built from rotating chains of compromised SOHO routers, IoT devices and enterprise equipment. Its operators used anti-forensic techniques, split operations into isolated compartments and cleaned up after each one.

The network carried the critical phases of attacks: vulnerability exploitation, credential theft, data exfiltration and maintaining access to victim environments. The attackers chose organizations that could lead them to downstream customers, sensitive networks or strategic programs. They paid particular attention to endpoint and network management systems, SD-WAN orchestrators and control plane technologies. The researchers counted hundreds of victims: telecom providers, government bodies, defense contractors, satellite services, universities, IT firms, and water, energy, transportation and emergency services.

Four zero-days

It was already known that Volt Typhoon had exploited a flaw in Versa Director (CVE-2024-39717) to deploy the VersaMem web shell. According to Black Lotus Labs, this was just one of four confirmed campaigns run through Silent Train. The other three affected:

• N-able N-central: insecure deserialization and command injection (CVE-2025-8875 and CVE-2025-8876);
• Cisco Catalyst SD-WAN Controller: authentication bypass (CVE-2026-20127);
• Arista VeloCloud Orchestrator: OS command injection (CVE-2026-16812).

The group is also suspected of exploiting a likely zero-day in Quest KACE before it was patched in October 2025. That campaign is estimated to have hit more than 30 victims.

Single-use chains

Silent Train began taking shape around November 2023, weeks before the first operation against KV-botnet, a botnet linked to Volt Typhoon. After the second operation, in late January 2024, the network's activity surged. The group dropped persistent infrastructure and moved to single-use chains it could rebuild on demand.

Traffic passed through several links. It started at temporary VPS outside the US, moved through compromised SOHO and IoT devices in various countries, and exited through devices on US soil. This let the attacks slip past geofencing and IP reputation blocklists. At least 27 device classes were pulled into the network, from TP-Link, Intelbras, NETGEAR and Zyxel to Fortinet, Cisco and PRTG. Sessions lasted about four hours on average, and once they ended the operators removed every artifact.

Some devices had fixed roles. Intelbras modems served only as relays, while Netgear Orbi and Fortinet FortiGate acted as US-based intermediate and exit nodes. By early 2025 the architecture had become hybrid, with enterprise devices kept in the network for one to three months on average. Later came reverse-tunnel variants built on Chisel and FRP.

Inside the US, the attacks focused on Hawaii, California and Texas, which host major military installations, telecom infrastructure and defense contractors. In the researchers' assessment, the group deliberately maintained access to systems that would matter in a crisis in the Indo-Pacific region.

Source: The Hacker News