Black Lotus Labs Says Volt Typhoon Built a Disposable Relay Network Called Silent Train to Hide Zero-Day Attacks on Management Platforms, Tearing Down Each Chain After About Four Hours

SINGAPORE - For three years, the Chinese state-sponsored group Volt Typhoon has hidden its most sensitive intrusions behind a relay network that barely exists, according to a report published Wednesday by Black Lotus Labs, the threat research arm of Lumen Technologies. The researchers call it Silent Train: chains of hijacked routers, IoT devices and enterprise appliances that are built on demand, used against a handful of targets, wiped clean and replaced.

Through that network, Black Lotus Labs says, Volt Typhoon ran at least four confirmed zero-day campaigns and one likely one, all aimed at the same kind of system: the management and control-plane platforms that already hold administrative reach over thousands of devices and, in many cases, an organization's customers. The lab says its monitoring led to hundreds of victim notifications in telecommunications, government, defense, satellite communications, universities, managed service providers and critical infrastructure.

"For enterprise leaders, the lesson is clear: systems with broad administrative reach can become high-value gateways to the entire organization and its customers," the report says.

A relay chain that is gone by the time anyone looks

Black Lotus Labs first saw consistent Silent Train activity in November 2023, shortly before the first takedown of KV-botnet, the router network the FBI and Justice Department disrupted to blunt Volt Typhoon's earlier operations. Activity grew after the second disruption. Instead of rebuilding a persistent botnet, the group moved to disposable chains.

A typical session starts on a virtual private server outside the United States, passes through a second VPS from a different provider, hops across compromised small office and home office or IoT devices abroad, and exits through a compromised device inside the United States so the traffic clears geo-blocking and IP reputation filters. The lab counted more than 27 device classes in use, from TP-Link routers and Netgear Orbi units to Fortinet appliances and CyberPanel servers, in chains of four to six hops.

"To construct these sessions, its operators exploit exposed web interfaces on SOHO, IoT and other relay devices, then deploy only the tooling needed to enable chained SSH access through the compromised node," the report says. That tooling was temporary SSH services, keys, configuration files and built-in utilities, and the operators removed all of it when the session ended. Sessions averaged about four hours, and some lasted only minutes.

"Volt Typhoon demonstrated a repeatable capability to rebuild a new chain with different infrastructure in less than two minutes, making the number of nodes at any one moment effectively close to zero," Michael Horka, the Black Lotus Labs engineer who led the research, told CyberScoop.

The discipline extended to roles. Intelbras modems appeared only as overseas relays, and Netgear Orbi devices only as the U.S. hops that touched victims, for the full three years. By early 2025 the network had turned hybrid: compromised enterprise systems were kept for one to three months as stable final hops, and some operations swapped SSH hops for reverse tunnels through the open-source proxies Chisel and FRP. Activity clustered Monday through Friday between 09:00 and 22:00 China Standard Time, with multiweek pauses around Chinese New Year, which the lab reads as human operators rather than automation. Each session typically focused on one to five victims.

Zero-days aimed at the control plane

The zero-day campaigns Black Lotus Labs tied to Silent Train run from late 2023 to this summer:

• Quest KACE, the endpoint management suite, where the lab assesses with moderate confidence that an undisclosed flaw was exploited against more than 30 victims, with activity declining after Quest's October 2025 security updates. The actor stayed on the KACE server and used its administrative reach to harvest and exfiltrate credentials rather than move laterally.
• Versa Director, CVE-2024-39717, in mid-2024, followed by an in-memory JAR webshell.
• N-able N-central, the chained flaws CVE-2025-8875 and CVE-2025-8876.
• Cisco Catalyst SD-WAN, CVE-2026-20127, a CVSS 10.0 control-plane flaw, exploited from late 2025 and well after Cisco disclosed it in February 2026.
• VeloCloud Orchestrator, CVE-2026-16812, the third SD-WAN platform the group went after.

The logic, the lab argues, is that a management platform hands an intruder the inventory, credentials and remote administration that would otherwise take weeks of noisy lateral movement to assemble. Post-incident work with partners found in-memory webshells, credential harvesting and abuse of native features such as endpoint control and remote file transfers, and in several cases the actors erased or altered logs. Beyond the zero-days, the lab observed the group targeting Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto Networks, ServiceNow and ArcGIS technology. Hawaii, California and Texas were the most targeted states.

What defenders can do with it

Black Lotus Labs' recommendations read like a checklist for any SOC that owns RMM, SD-WAN or endpoint management consoles. Put heightened controls on network and endpoint management systems, SD-WAN orchestrators and out-of-band platforms, and review the permissions and downstream trust they grant. Keep administrative interfaces off the open internet behind VPNs, jump hosts or dedicated management networks, and patch those platforms first. Centralize logging and extend retention, especially for internet-facing systems with elevated administrative access, because an actor that cleans up behind itself leaves little else.

For hunting, the lab points to unusual administrative logins, abnormal API use, remote file transfers, configuration changes and "live off the land" activity outside normal administrative hours or workflows, and to the CISA and NCSC guidance on Volt Typhoon and on China-nexus covert networks of compromised devices. The relay IPs themselves are of little use. As Horka put it to CyberScoop, "What exists today will be completely different tomorrow."