Volt Typhoon targeted enterprise control planes via ever-changing “Silent Train” relay network
Volt Typhoon, a Chinese state-sponsored APT group that’s focused on cyberespionage and United States’ critical infrastructure, has been using a covert, constantly rotating relay network to hide its most sensitive intrusions, Lumen’s Black Lotus Labs revealed on Wednesday.
This network, dubbed Silent Train by the researchers, consists of chains of compromised SOHO and IoT devices (e.g., TP-Link and Netgear routers) and enterprise systems (e.g., Fortinet and Cisco appliances, PRTG and CyberPanel servers).
Through it, the group exploited zero-days in network and endpoint management systems, SD-WAN orchestrators and other control plane infrastructure. Among the targeted solutions were:
- Versa Director (via CVE-2024-39717)
- N-Able N-Central (via CVE-2025-8875 and CVE-2025-8876)
- Cisco Catalyst SD-WAN (through CVE-2026-20127)
- VeloCloud Orchestrator (via CVE-2026-16812), and
- Quest KACE (possibly through an unknown zero-day vulnerability)
“Compromising these technologies offers significant operational benefits,” the researchers noted. Instead of having to – step-by-step and more noisily – traverse networks, identify administrators, locate key systems and establish multiple footholds, the group was able to achieve all of that with much less effort, no lateral movement required, and without leaving many forensic artifacts behind.
“Post-incident analysis with partners uncovered in-memory webshells, credential harvesting and abuse of native features such as endpoint control and remote file transfers. In several cases, the actors also erased or altered logs and other evidence of exploitation and operator activity,” the researchers explained.
Beyond these campaigns, Black Lotus Labs observed the group using Silent Train to target “a broad range of edge, identity, network and enterprise management technologies, including Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto, ServiceNow and ArcGIS,” though the researchers couldn’t always determine whether known or unknown vulnerabilities were exploited.
In a separate blog post published on Wednesday, Cisco Talos researchers detailed how UAT-11473, a group whose “operating infrastructure overlaps considerably with Volt Typhoon’s ‘Silent Train’ covert access network”, exploited CVE-2026-20127 to compromise Cisco SD-WAN Catalyst Controller instances and deploy KeyDrift, a custom malware framework.
KeyDrift provides persistent access to the controllers and extracts and exfiltrates control-session metadata and data-plane keying material.
How Silent Train works
Volt Typhoon began building the Silent Train network before the December 2023 takedown of the KV botnet, and ramped up its use in its aftermath.
“Traditional botnets often rely on persistent, centralized or recurring patterns, making them easier for defenders to detect. Silent Train took a different approach: instead of maintaining a permanent network, Volt Typhoon rapidly assembled and dismantled transient infrastructure, creating a resilient, secure and compartmentalized framework that protected valuable access,” Black Lotus Labs noted.
The group expanded this infrastructure gradually, adding new types of compromised devices over time (more than 27 device classes in all). Early chains relied on SOHO and IoT devices (e.g., TP-Link, Netgear, Intelbras, Zyxel, Ruckus and Cambium), which were exploited via exposed web interfaces, used for a single session and then restored to their original state.
Later, the group added enterprise platforms such as Fortinet, Cisco, PRTG, Mirth Connect and CyberPanel as final hops before the victim.
While Volt Typhoon uses other infrastructure for reconnaissance, Silent Train was reserved for “exploitation, credential access, data exfiltration and ongoing engagement with victim environments,” researchers found.
Sessions start from virtual private servers outside the US, pass through compromised overseas devices, and then exit via one or more US-based devices before reaching the victim, which helps the traffic blend in and bypass geo-blocking and IP reputation filters. “In some cases, as many as six hops separated the operator from the victim,” Black Lotus Labs noted.
Example of a Silent Train session (Source: Black Lotus Labs)
“As Silent Train matured, reverse-tunnel variants were introduced alongside the traditional SSH-chaining model. Rather than exposing temporary SSH services on each hop and pivoting sequentially through the chain, some operations mixed in reverse tunnels via open-source proxies like Chisel and FRP, sending traffic from compromised devices to upstream infrastructure,” the researchers added.
Victimology
Over the past three years, Black Lotus Labs’ monitoring of Silent Train has led to hundreds of victim notifications.
The group was selective in its targeting: each session typically went after one to five victims, and often just a single organization.
Among the victims are US government entities, telecommunications providers, defense contractors, satellite and mission-critical communications providers, managed service providers (MSPs), IT firms, universities with military affiliations, and critical infrastructure organizations in sectors such as water, energy, transportation, aviation and emergency services.
These sectors may look diverse, but the researchers say they share a common trait: “each offers access to broader networks, customers or essential operations.”
Geographically, Hawaii, California and Texas were the most frequently targeted states. They host major military installations, defense contractors, telecom and satellite infrastructure, and logistics networks that support US operations in the Indo-Pacific region.
According to the researchers, this pattern is consistent with an effort to pre-position access in strategic communications and critical infrastructure ecosystems that would become essential during geopolitical tensions or a crisis.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
