Volt Typhoon’s Silent Train: A Covert Network for Zero-Day Exploitation
Lumen Technologies’ Black Lotus Labs revealed that the Chinese state-sponsored group Volt Typhoon used a covert network called Silent Train to infiltrate US critical infrastructure. This system relies on rotating chains of compromised devices to bypass detection, exploiting zero-day vulnerabilities in management platforms to steal credentials and maintain long-term access.
Key points
- Silent Train uses ephemeral, multi-hop chains of compromised SOHO, IoT, and enterprise devices to obscure attacker origins.
- The network targets centralized management platforms (e.g., Fortinet, Cisco, N-able) to gain broad administrative access without lateral movement.
- Volt Typhoon exploited at least four confirmed zero-day vulnerabilities, including CVE-2026-20127 in Cisco Catalyst SD-WAN and CVE-2025-8875/8876 in N-able N-Central.
- Operations are highly disciplined, with sessions lasting minutes to hours, followed by complete forensic cleanup to erase traces.
- Targets are concentrated in Hawaii, California, and Texas, focusing on defense, telecom, and critical infrastructure sectors.
Background
Volt Typhoon has been active since at least 2021, previously linked to the KV-botnet. Recent disruptions of that botnet in 2023 led the group to develop Silent Train as a more resilient, disposable alternative. Earlier coverage highlighted the group's focus on pre-positioning for potential conflicts in the Indo-Pacific region.
How outlets are covering it
Black Lotus Labs emphasizes the operational discipline and anti-forensic nature of Silent Train, noting its evolution from ephemeral relays to hybrid models using reverse tunnels. The Hacker News highlights the specific zero-day campaigns and the strategic targeting of control plane technologies. Both sources agree on the group's focus on maintaining access to critical US infrastructure, particularly in the Indo-Pacific region, though Black Lotus Labs provides more detail on the technical architecture and device compartmentalization.
Why it matters
The revelation of Silent Train exposes a sophisticated method for state-sponsored actors to maintain persistent access to critical infrastructure. The use of zero-day exploits against centralized management platforms poses a significant risk to organizations relying on these systems for broad administrative control. Understanding these tactics is crucial for improving detection and response in high-value sectors.
What to watch
Organizations should prioritize patching known vulnerabilities in management platforms, reducing internet exposure of critical systems, and strengthening access controls. Security teams should monitor for unusual activity in control plane technologies and preserve telemetry to detect and respond to potential intrusions.
- Silent Train: Volt Typhoon’s Sophisticated Infection Chain into US Targets Exposed ZERO DAY
- A breakthrough for the group on the trail of Chinese hackers NPR
- Silent Train: uncovering Volt Typhoon's operational framework for zero-day exploitation and strategic access Lumen Technologies
- Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns The Hacker News
- China’s ‘Volt Typhoon’ quietly built another hacking network following US crackdown, new findings say Nextgov/FCW
Want the full story? Read the original reporting
Read on ZERO DAY