The China-linked espionage group Volt Typhoon has been linked to a covert access network called Silent Train, used to carry out zero-day exploitation and maintain strategic access, according to a report from Lumen Technologies' Black Lotus Labs shared with The Hacker News. First spotted in late 2023, the network runs on rotating chains of compromised SOHO, IoT and enterprise devices, with anti-forensic measures and cleanup after each operation.
Black Lotus Labs tied Silent Train to four confirmed zero-day campaigns: a Versa Director flaw (CVE-2024-39717), insecure deserialization and command injection bugs in N-able N-central (CVE-2025-8875 and CVE-2025-8876), an authentication bypass in Cisco Catalyst SD-WAN Controller (CVE-2026-20127), and an OS command injection in Arista VeloCloud Orchestrator (CVE-2026-16812). Volt Typhoon is also suspected of exploiting a likely zero-day in Quest KACE before it was patched in October 2025, a campaign estimated to have hit more than 30 victims.
Hundreds of victims have been identified across telecommunications, government, defense contractors, satellite and mission-critical communications, universities, IT firms, and critical infrastructure including water, energy, transportation, maritime, rail, aviation and emergency services. The group repeatedly targeted endpoint management platforms, network management systems, SD-WAN orchestrators and control plane technologies.
Silent Train is described as a layered, multi-hop framework: sessions start from VPS infrastructure outside the U.S., pass through compromised non-U.S. SOHO and IoT devices, and exit via U.S.-based compromised devices to evade geofencing and IP reputation blocklists. At least 27 device classes have been enrolled, from TP-Link, Intelbras, Ruckus Wireless, SATO, NETGEAR, Zyxel and Cambium gear to Fortinet, Cisco, PRTG, Mirth Connect and CyberPanel platforms. Sessions averaged about four hours, some lasting only minutes.
The capability took shape around November 2023, weeks before the first disruption of the KV-botnet, and activity surged after the botnet's second disruption in late January 2024. By early 2025, Silent Train had shifted to a hybrid architecture retaining enterprise-grade devices for one to three months, later adding reverse-tunnel variants using open-source proxies Chisel and FRP. Hawaii, California and Texas emerged as focus areas, which Black Lotus Labs said reflects deliberate efforts to hold access to ecosystems supporting defense, logistics, communications and military operations, especially during heightened tensions in the Indo-Pacific.
Source: The Hackers News