Volt Typhoon Linked to Silent Train Covert Access Network

Volt Typhoon, a China-linked cyber espionage group, used a now-disrupted covert access network called Silent Train for zero-day exploitation, credential access, data exfiltration, and strategic access, according to Black Lotus Labs at Lumen Technologies. The network relied on rotating chains of compromised SOHO, IoT, and enterprise devices and targeted entities that could provide scalable access to downstream customers, sensitive networks, or strategic programs.

Four Zero-Day Campaigns

Black Lotus Labs attributed four confirmed zero-day campaigns to Volt Typhoon through Silent Train. One was a file upload vulnerability in Versa Director, CVE-2024-39717, used to deliver the VersaMem web shell. The other three were CVE-2025-8875 and CVE-2025-8876 in N-able N-central, CVE-2026-20127 in Cisco Catalyst SD-WAN Controller, and CVE-2026-16812 in Arista VeloCloud Orchestrator. Volt Typhoon is also suspected of using a likely zero-day in Quest KACE before it was patched in October 2025, in a campaign estimated to have impacted more than 30 victims.

How Silent Train Operated

Silent Train used rapidly rotating chains of compromised devices that were exploited on demand, used against selected targets, cleaned up after operations, and refreshed. Its sessions were short-lived, averaging about four hours, and operators removed artifacts before dismantling each chain. The framework relayed malicious traffic through several devices, including virtual private servers outside the U.S., non-U.S. SOHO and IoT devices, and U.S.-based compromised devices that served as exit nodes.

No less than 27 device classes were exploited and enrolled, ranging from SOHO and IoT devices such as TP-Link, Intelbras, Ruckus Wireless, SATO, NETGEAR, Zyxel, and Cambium to enterprise platforms such as Fortinet, Cisco, PRTG, Mirth Connect, and CyberPanel. Intelbras modems appeared only as relay nodes, while Netgear Orbi and Fortinet FortiGate appliances served as U.S.-based intermediary and exit points. By early 2025, Silent Train is believed to have evolved into a hybrid architecture that retained enterprise-grade devices for an average of one to three months. It later introduced reverse-tunnel variants using open-source proxies such as Chisel and FRP.

Targets and U.S. Focus

The network singled out entities that could provide scalable access to downstream customers, sensitive networks, or strategic programs, and targeted endpoint management platforms, network management systems, SD-WAN orchestrators, and control plane technologies. Hundreds of victims were identified across telecommunications providers, government, defense contractors, satellite and mission-critical communication services, universities, IT firms, and critical infrastructure such as water, energy, transportation, maritime, rail, aviation, and emergency services. Within the U.S., Hawaii, California, and Texas were focus areas because they host major military installations, telecommunications infrastructure, defense contractors, satellite communications providers, and critical logistics networks.

Sources: The Hacker News