China-Linked 'Volt Typhoon' Exploited 4 Zero-Days via Disposable Relay Network, Lumen ...

Black Lotus Labs, the threat research unit of US telecom giant Lumen Technologies, on October 28 published findings on "Silent Train," a stealth relay network believed to have been operated by the China state- cyberattack group known as Volt Typhoon. The report revealed that the group used a relay network that rapidly swapped out compromised devices as a foothold to exploit unknown vulnerabilities (zero-days) lurking in enterprise management-platform products. The tracking period spanned roughly three years, and hundreds of organizations, including critical infrastructure operators, are said to have been affected.

Black Lotus Labs has continuously monitored Silent Train since first observing it around November 2023. In the course of that work, it sent hundreds of notifications to victim organizations and identified zero-day exploitation through subsequent analysis. Four cases were confirmed and one is highly likely, all targeting products used to centrally manage large numbers of devices.

Note: CVSS is a common metric indicating vulnerability severity, with 10.0 being the maximum. The two N-central flaws are described as insecure deserialization and command injection, Catalyst SD-WAN as an authentication bypass, and VeloCloud Orchestrator as an OS command injection.

In particular, exploitation of Cisco's Catalyst SD-WAN reportedly continued even after the company disclosed the vulnerability in February 2026. Management products amount to a "master key for the whole company," and attackers appear to be aiming at the way a single compromised device can lead to lateral movement into business partners and downstream customers.

Silent Train's mechanism is a multi-stage relay network that chains together compromised routers, IoT devices, and other equipment. Virtual private servers (VPS) serve as temporary stepping stones, traffic is routed through SOHO and IoT devices outside the United States, and compromised devices inside the United States serve as exit nodes to reach victim organizations. This is said to be effective at evading geographic restrictions and IP-reputation blocklists.

More than 27 types of devices were used for relaying. These include SOHO and IoT devices from TP-Link, NETGEAR, Zyxel, Intelbras, and Ruckus Wireless, as well as enterprise infrastructure from Fortinet, Cisco, PRTG, Mirth Connect, and CyberPanel. A notable feature is that roles were fixed by device type: Intelbras modems were dedicated relay nodes, while NETGEAR Orbi and Fortinet FortiGate devices were used as intermediate and exit points inside the United States.

The average connection lasted four hours, with some ending within minutes. Stringing devices together was completed in under two minutes, and at the end of an operation all traces—temporary SSH services, keys, configuration files, and the like—were erased as the relay network was dismantled. Black Lotus Labs analyzed that "the operational discipline stands out: rather than persistent relays or C2 (command) infrastructure, they stuck to short-lived, self-managed sessions."

In early 2025, the operation evolved from a fully disposable relay network to a hybrid model that retained enterprise devices for roughly one to three months. A reverse-tunnel variant using the open-source proxies "Chisel" and "FRP" also appeared, suggesting the platform's maturation.

Victims spanned telecom carriers, government agencies, defense contractors, satellite and emergency communications services, universities, and IT companies, as well as critical infrastructure including water, energy, transportation, maritime shipping, rail, aviation, and emergency services. Within the United States, the three states of Hawaii, California, and Texas were especially heavily affected—all regions where military facilities, communications infrastructure, defense contractors, satellite communications operators, and logistics networks are concentrated.

The activity is seen as consistent with a move to secure footholds in preparation for a phase of heightened tension in the Indo-Pacific region. The prototype of Silent Train appeared around November 2023, weeks before the first disruption of the China-linked IoT botnet "KV-botnet." When KV-botnet was disrupted again in late January 2024, Silent Train's activity surged, shifting to short-lived infrastructure spanning diverse devices and regions.

As countermeasures, Black Lotus Labs recommends minimizing internet exposure of management platforms, prioritizing patching, aggregating logs and extending retention periods, and monitoring for suspicious use of administrative privileges.

The disclosure highlights a pattern in which state- groups repeatedly target centrally managed products to secure scalable access to downstream customer networks and critical infrastructure. Because the supply chain of management products cascades to business partners, damage does not stop at the directly compromised organization. For Japanese companies as well, there is an urgent need to review exposure and strengthen monitoring regimes on the premise that "management-side" products such as SD-WAN and endpoint management tools can become attack surfaces.