Volt Typhoon hid zero-day attacks behind rotating 'Silent Train' relay network
Black Lotus Labs says the Chinese state-linked group chained compromised routers and modems to mask attacks on edge and management systems, then wiped its tooling after each operation.
Researchers at Black Lotus Labs, the threat research arm of Lumen, say the Chinese state-sponsored group Volt Typhoon has been running attacks through a disposable relay network they call Silent Train. The report was published October 28, 2026, and covered by BleepingComputer the same day.
According to the researchers, operators route traffic through VPS infrastructure outside the United States, then through compromised devices acting as intermediate relays. Intelbras modems served as overseas relays, while Netgear Orbi devices acted as hops inside the U.S. The group deploys only what it needs for chained SSH access, including temporary SSH services, keys and configuration files, and typically removes everything in under eight hours.
Black Lotus Labs says it tracked the framework for three years and confirmed Volt Typhoon exploited at least four zero-day vulnerabilities against edge and management infrastructure. Named products include VeloCloud Orchestrator, Cisco Catalyst SD-WAN, N-able N-central and Versa Director, plus a suspected zero-day in Quest KACE. The researchers say the group's activity clusters around California, Texas and Hawaii, and that it worked in China Standard Time.
Targets reportedly span telecoms, government, defense contractors, utilities, satellite providers, MSPs and emergency services. The researchers link part of the shift to the FBI's disruption of the KV-Botnet.
Their advice: restrict internet access to administrative interfaces, patch quickly, keep logs longer, and watch for unusual admin activity and trusted connections into partner networks.
CVE references
Sources
- Volt Typhoon hides zero-day attacks using 'Silent Train' frameworkPrimarywww.bleepingcomputer.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning