A newly detailed intelligence report reveals that China-linked hacker group Volt Typhoon has operated a secret network dubbed “Silent Train” to conceal zero-day attacks targeting the U.S. government, defense contractors, and critical infrastructure. This covert framework chains together compromised routers, enterprise servers, and connected devices to mask the origin of the attack. The findings are based on over three years of investigation by cybersecurity firm Lumen’s Black Lotus Labs, which issued hundreds of victim notifications. Silent Train is not a single malware family, but a flexible operational design that includes in-memory webshells to minimize traceability.
How the Silent Train Works
First observed in late 2023, Silent Train emerged as Volt Typhoon shifted tactics from the now-disrupted KV botnet. Earlier reports had already shown the group’s exploitation of compromised networking hardware serving as covert relays. The model described in Lumen’s October 28 report reveals a tightly controlled network structure: sessions initiate on virtual private servers abroad, pass through overseas compromised devices, then use domestic U.S. systems as exit nodes before reaching their ultimate target. Some attack chains used up to six intermediary hops to evade detection and to obscure origin.
The compromised device pool spans more than 27 classes, such as TP-Link routers, Netgear Orbi units, Fortinet appliances, and CyberPanel servers. Attackers exploited exposed web interfaces, created temporary SSH services and keys, and manipulated configuration files. Chains can be assembled in under two minutes, stay active typically for about four hours, and are dismantled after operations. Over time, enterprise systems provided more persistent final footholds with connections lasting one to three months. Reverse tunnels were occasionally used in lieu of purely sequential SSH hops.
Targets, Platform Exploits, and Threat Profiles
Silent Train has repeatedly exploited centralized management platforms—tools that often have broad network reach and privileged access. Among the compromised platforms are N-central management servers, Versa Director, Cisco Catalyst SD-WAN, VeloCloud Orchestrator, and Quest KACE. In one campaign, a malicious JAR webshell was executed in memory on a Versa system; Cisco’s SD-WAN vulnerabilities were re-exploited even after public disclosure. In the Quest KACE incident, over 30 victims were identified before updates reduced activity.
Geographically, the campaigns have focused on U.S. states including Hawaii, California, and Texas, with victims spanning telecommunications firms, satellite communications providers, universities involved in defense, and operators of essential services. Attack timing follows a pattern consistent with Chinese Standard Time work hours—Mondays through Fridays between 09:00 and 22:00—with less activity overnight or on weekends. Usually only one organization is targeted per session.
Defensive Measures and Indicators of Compromise
Lumen’s report includes several known exploited vulnerabilities: N-central vulnerabilities (CVE-2025-8875, CVE-2025-8876), a Cisco SD-WAN vulnerability (CVE-2026-20127), and a VeloCloud bug (CVE-2026-16812). Observed indicators of compromise (IoCs) include in-memory webshells, temporary SSH artifacts, tampering or deletion of logs, abuse of file-transfer and remote administration features, and use of reverse tunneling tools like Chisel or FRP.
To mitigate this threat, the report recommends restricting internet-facing management interfaces, patching vendor software promptly, and reviewing downstream trust relationships. It also advises exporting logs to external systems, ensuring lengthy retention, and closely monitoring for anomalous administrative or API behavior—especially since attackers are capable of erasing or altering local evidence.
Analytical Takeaway: The discovery of Silent Train confirms a significant evolution in Volt Typhoon’s tactics. Rather than relying solely on known malware or brute force attacks, they are now leveraging agility, anonymity, and strategic platform compromise to reach sensitive targets. For organizations, this means that traditional defenses—patching and perimeter monitoring—are no longer sufficient. Instead, defenders must assume adversaries could already be hidden inside trusted infrastructure, requiring deeper visibility, tighter access controls, and constant review of administrative pathways. The window for discovery is shrinking—attack chains are built in minutes, live for hours. Future armoring efforts must focus not just on preventing access but on detecting abuse of privileged systems and trust relationships.
