Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns

The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train, which has been employed for zero-day exploitation and strategic access.

According to a report from Lumen Technologies Black Lotus Labs, Silent Train was first identified in late 2023 and utilizes rotating chains of compromised SOHO, IoT, and enterprise infrastructure. The network employs anti-forensic techniques, compartmentalized operations, and post-operation cleanup to minimize detection and attribution.

Silent Train’s primary function is to facilitate critical attack phases such as vulnerability exploitation, credential access, and data exfiltration while maintaining continued access to victim environments. This activity is notable for two main reasons:

• It targets entities that can provide scalable access to downstream customers, sensitive networks, or strategic programs.
• It focuses on endpoint management platforms, network management systems, SD-WAN orchestrators, and control plane technologies crucial to enterprise environments.

Hundreds of victims have been identified across various sectors, including telecommunications, government, defense contractors, satellite services, universities, IT firms, and critical infrastructure such as water, energy, transportation, and emergency services.

Volt Typhoon, also known by several aliases including Bronze Silhouette and Insidious Taurus, is a state-sponsored group linked to China, recognized for targeting critical infrastructure networks, particularly in communications, energy, and transportation.

Active since at least 2021, the group was previously observed exploiting a file upload vulnerability in Versa Director as a zero-day (CVE-2024-39717) to deploy a web shell called VersaMem, designed to harvest credentials and enable access to downstream customers.

Recent findings from Black Lotus Labs indicate that the security flaw in Versa Director was one of four confirmed zero-day campaigns conducted through Silent Train. The other three vulnerabilities include:

• CVE-2025-8875 and CVE-2025-8876 – Insecure deserialization and command injection vulnerabilities in N-able N-central.
• CVE-2026-20127 – An authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller.
• CVE-2026-16812 – An operating system command injection vulnerability in Arista VeloCloud Orchestrator.

Additionally, Volt Typhoon is suspected of exploiting a likely zero-day vulnerability in Quest KACE before it was patched in October 2025, impacting over 30 victims.

Black Lotus Labs described Silent Train as a network built around rapidly rotating chains of compromised devices, which are exploited on demand, used against carefully selected targets, and cleaned up after each operation. This model has allowed Volt Typhoon to conduct operations with exceptional security while minimizing detection risks.

A defining characteristic of these attacks is the repeated targeting of systems that provide broad visibility and control across large enterprise environments of strategic value to the U.S.

Interestingly, the covert access capability began to develop around November 2023, shortly before the first disruption targeting KV-botnet, an IoT botnet linked to multiple China-nexus state-sponsored threat actors, including Volt Typhoon.

Following the second disruption of the KV-botnet in late January 2024, Silent Train’s operational activity reportedly surged, shifting to an ephemeral infrastructure comprising diverse device types across various geographies.

Rather than relying on persistent infrastructure, Volt Typhoon adopted a model using one-time-use chains of compromised devices that could be rebuilt as needed. This approach allowed for rapid assembly and dismantling of transient infrastructure, creating a resilient and secure framework.

Silent Train is described as a “layered, multi-hop framework,” enabling operators to relay malicious traffic through several devices before reaching targets, thereby obscuring its origins. Each link in the chain serves a specific purpose:

• Virtual private servers (VPS) act as temporary staging areas, allowing threat actors to provision and discard them after each session, starting from VPS infrastructure located outside the U.S.
• Compromised non-U.S. SOHO and IoT devices conceal the attack’s starting point.
• U.S.-based compromised devices function as exit nodes before reaching domestic victims, helping to evade geofencing and IP reputation blocklists.

At least 27 device classes have been exploited, ranging from SOHO and IoT devices to enterprise platforms. Black Lotus Labs noted that Silent Train stands out for its operational discipline, focusing on short-lived, self-managed sessions rather than persistent relays.

By early 2025, Silent Train is believed to have evolved from a completely ephemeral relay network to a hybrid architecture, retaining enterprise-grade devices for one to three months instead of changing them after each engagement.

The maturation of the platform introduced reverse-tunnel variants that utilized open-source proxies to send traffic from infected devices to upstream infrastructure.

Within the U.S., states such as Hawaii, California, and Texas have emerged as focal points for Silent Train operations, hosting major military installations, telecommunications infrastructure, and critical logistics networks.

Black Lotus Labs stated that the victimology indicates deliberate efforts to maintain access to critical ecosystems supporting defense, logistics, and communications, particularly during heightened tensions in the Indo-Pacific region.

The resulting picture reveals a highly structured framework designed to acquire, protect, and sustain strategic access at scale, with Volt Typhoon systematically pursuing and preserving access to significant networks in the United States.

 

Source: The Hacker News