Chinese state-linked espionage group Volt Typhoon has been tied to a recently dismantled covert network dubbed “Silent Train,” used to execute at least four zero-day campaigns targeting high-impact infrastructure. The network enabled exploitation, credential theft, and persistent access via endpoint management and control plane platforms, especially those deeply embedded in enterprise environments. Silent Train was exposed in a report today by Black Lotus Labs at Lumen Technologies.
What Silent Train is and how it operated
First detected in late 2023, Silent Train was built around rapidly rotating chains of already-compromised SOHO (small office/home office), IoT, and enterprise devices. Its strategy centered on compartmentalization—each operation used only what was needed, removed all traces afterward, and refreshed the device chain to evade detection. Command and control infrastructure was intentionally ephemeral, reducing the risk of attribution or disruption.
The attacks focused on components that provide wide visibility or access across enterprise systems—things like SD-WAN controllers, network orchestration platforms, remote management systems, and central control planes. Hundreds of victims have so far been linked to Silent Train, spanning telecom providers, governments, defense contractors, satellite operations, universities, IT firms, and industries including aviation, rail, energy, water, maritime, and emergency services—in both critical infrastructure and strategic sectors.
Zero-days exploited and targets compromised
Four confirmed zero-day vulnerabilities were deployed through Silent Train. They include an insecure deserialization and command injection in N-able N-central (CVE-2025-8875 & CVE-2025-8876), an authentication bypass in Cisco Catalyst SD-WAN Controller (CVE-2026-20127), an operating-system command injection in Arista VeloCloud Orchestrator (CVE-2026-16812), and a previously exploited zero-day in Versa Director (CVE-2024-39717) used to deliver a credential-stealing web shell dubbed “VersaMem.” Additionally, Volt Typhoon likely exploited a zero-day in Quest KACE before that vulnerability was patched in October 2025, affecting over 30 victims.
Silent Train’s architecture relied on multistep relay chains. It used foreign VPS nodes as staging points, compromised non-U.S. SOHO/IoT devices as middle hops, and U.S.-based compromised devices as exit nodes to mask origins and bypass IP reputation lists. Dozens of device types fell under abuse—from home routers, modems, wireless access points by vendors like TP-Link, Netgear, Zyxel, and Intelbras, to enterprise appliances from Fortinet, Cisco, and Arista. Sessions were generally brief—most operations lasted around four hours, some only minutes.
By early 2025, the group’s tactics evolved: enterprise-grade devices stayed in the network longer (one to three months) instead of being swapped per operation. New tools like open-source proxies (Chisel, FRP) were introduced for reverse-tunnel setups, allowing infected endpoints to send traffic back upstream. Geographically, Hawaii, California, and Texas emerged as major focus areas, likely due to their concentration of military, communication, defense, and strategic infrastructure assets.
Volt Typhoon, also known by aliases such as Bronze Silhouette, Insidious Taurus, UNC3236, Vanguard Panda, and Voltzite, has been active since at least 2021. Their campaigns have heavily targeted sectors and systems essential to national security and civilian life—highlighting not just the scale, but the persistence and precision of this threat actor’s operations.
Silent Train represents a leap in how state-linked actors are designing zero-day exploitation and access frameworks: short-life, self-contained, rotational chains rather than static command-and-control infrastructure. This model complicated efforts to detect, attribute, and defend against attacks—allowing Volt Typhoon to strike deep into systems whose compromise would yield broad visibility or control.
This exposure should be a wake-up call. For organizations operating critical infrastructure, the focus must be on detecting not just signatures or static infrastructure, but transient and modular attack paths that disassemble themselves. As Volt Typhoon’s tools mature, expect more pressure on enterprise and device vendors to tighten supply chains, patch cycles, and forensic mechanisms. Monitoring for ephemeral sessions, odd relay nodes, or brief but strategic access should become part of standard defense posture moving forward.
