China's Volt Typhoon Breached Hundreds of US Networks via Self

Researchers at Lumen Technologies' threat intelligence division, Black Lotus Labs, released today the most technically detailed public account of how Chinese state- hackers have been systematically breaching America's most sensitive networks — closing the gap between years of government alarms and the technical evidence that had, until now, been kept out of public view. The report's findings are available in the Black Lotus Labs Silent Train report .

The group at the center of the investigation — Volt Typhoon, a Chinese government-linked hacking operation — has been described by former FBI Director Christopher Wray as "the defining threat of our generation." What the Black Lotus Labs report provides, for the first time, is the architectural explanation for why that description is not hyperbole: Volt Typhoon built an attack infrastructure that leaves essentially nothing for forensic investigators to find — and then used it to quietly compromise hundreds of organizations across American defense, telecommunications, water, energy, rail, maritime, and aviation sectors over three years. A January 31, 2024, Justice Department announcement confirmed the prior KV-Botnet disruption operation that preceded this new framework.

The framework is called Silent Train.

What Silent Train Is — and What Makes It Different

Silent Train is not a botnet in the conventional sense. Traditional botnets maintain a persistent network of compromised devices that defenders can identify, monitor over time, and eventually disrupt — as the FBI did with Volt Typhoon's prior infrastructure, the KV-Botnet, in a court-authorized disruption operation in January 2024. Silent Train was designed specifically to deny investigators any stable target.

Instead of maintaining a fixed command-and-control network, Volt Typhoon builds disposable chains of compromised devices, uses each chain exactly once for a single operation, and then dismantles it — scrubbing every artifact from every device in the chain before moving on. The full technical methodology is documented in the Black Lotus Labs Silent Train analysis .

"Rather than continue using persistent infrastructure, Volt Typhoon shifted to a model using one-time-use chains of compromised devices that it could rebuild as needed," Black Lotus Labs said in the report. "Volt Typhoon rapidly assembled and dismantled transient infrastructure, creating a resilient, secure, and compartmentalized framework that protected valuable access."

The researchers first spotted the anomaly in late 2023 while analyzing a separate covert network. They noticed SSH relay chains being used exactly once and then abandoned — the opposite of how covert networks normally behave. Three years of investigation followed. What they mapped is the architecture of a state-level adversary operating with the discipline and patience of a professional intelligence service.

How Each Chain Is Built

A Silent Train operation begins with a virtual private server (VPS) provisioned outside the United States. The attackers then chain through a second VPS in a different geographic region, then pivot to a compromised small office/ office (SOHO) router or internet-of-things (IoT) device located somewhere else abroad, then through a US-based device before finally reaching the target. The complete architecture is documented in the Black Lotus Labs operational framework report.

The US-based device is critical: it makes the incoming traffic appear to originate from an American IP address, bypassing firewall rules that block foreign addresses and evading IP reputation filters. The full chain typically involves four to six hops, each of which can only see its immediate neighbors — so no single device or vendor ever has visibility into the complete path.

Each chain is assembled in under two minutes, a speed that strongly suggests at least partial automation, as journalist Kim Zetter reported in her Zero Day account of Silent Train . When the session ends — typically around four hours, though some last only minutes — the operators wipe every artifact from every device in the chain: temporary SSH keys, configuration files, log entries, and tooling are all removed, and each device is restored to its prior state. Investigators who arrive after the fact find nothing, per the Silent Train technical report .

Mike Horka, the principal information security engineer at Black Lotus Labs who tracked the campaign and authored the public report, told journalist Kim Zetter: "This is not something that we have seen before on this scale and not with this level of operational security. There's an operational structure with Silent Train… which is very, very rare."

If Volt Typhoon needs to return to the same target — and the researchers found they do, sometimes returning 30 days later for a two-hour session and again a month after that for six hours — they build an entirely new chain using different devices, Zetter's Zero Day investigation confirmed . They also frequently use stolen credentials from the initial intrusion to re-enter the network, meaning the victim's own employee accounts become a repeated access vector.

Why Cleaning the Chain Matters More Than the Chain Itself

The erasure discipline is what elevates Silent Train from a sophisticated tool to a structurally difficult-to-detect threat. Most security forensics begins with what is left behind: malware samples, modified registry keys, SSH keys, unusual process activity, log entries showing anomalous connections. Silent Train is specifically engineered to produce none of those artifacts. When an organization calls an incident response team, the chain that brought the attacker in no longer exists.

This, combined with Volt Typhoon's consistent use of "living off the land" techniques — hijacking native operating system tools and legitimate administrative utilities rather than deploying custom malware — means that endpoint detection systems hunting for novel code signatures are effectively blind to Silent Train activity. A joint advisory from CISA, NSA, and FBI on this Volt Typhoon LOTL activity provides detailed mitigation guidance. The implication for defenders is direct: behavioral analytics, log centralization with extended retention, and monitoring of administrative workflows are the detection levers that remain, because signature-based detection has nothing to detect.

"At the end of operational sessions, they removed every artifact and dismantled the operational chain in their wake," Black Lotus Labs wrote — leaving "no evidence for defenders to uncover," per the Silent Train operational report .

Compartmentalization by Design

One of the more technically striking aspects of Silent Train, as Black Lotus Labs documented it, is that device classes were strictly assigned to roles within the chain — and those assignments never deviated over three years of observation, as detailed in the Black Lotus Labs Silent Train framework.

Intelbras modems, for instance, appear only as overseas relay nodes. Netgear Orbi devices appear only as US-based exit nodes interacting with victims. Fortinet FortiGate appliances function as US-based final hops. The attackers tracked more than 27 different device classes across the framework, spanning consumer-grade hardware (TP-Link routers, Ruckus Wireless access points, Zyxel devices) and enterprise platforms (Fortinet, Cisco appliances, PRTG network monitors, Mirth Connect, CyberPanel), all documented in the Silent Train technical framework report.

This compartmentalization limits what any single device vendor can see. A manufacturer's telemetry might show that its product is being exploited in Europe — but if that product type is never used in the US-based hops, the manufacturer cannot trace the full chain. Every layer is deliberately designed so that no single point of visibility reveals the whole.

Why Management Platforms Are the Real Target

The four confirmed zero-day campaigns Volt Typhoon conducted through Silent Train a common target profile: not individual endpoints, but management platforms that give administrators centralized visibility and control across entire enterprise environments, as described in the Volt Typhoon operational framework report.

This targeting strategy deserves specific attention, because it reveals a logic that standard endpoint-centric security postures are not designed to counter. An attacker who compromises an endpoint needs to move laterally — traversing the network, locating key systems, generating authentication events at each step. An attacker who compromises the management platform that administers those endpoints has already done the equivalent: the management system already has administrative access to every device it manages, detailed asset inventories, remote management capability, and trusted paths to downstream customer environments. No lateral movement required. Fewer authentication events. Fewer forensic artifacts.

"Compromising these technologies offers significant operational benefits," Black Lotus Labs wrote. "Threat actors typically need to traverse networks, identify administrators, locate key systems and establish multiple footholds to gain visibility. Volt Typhoon directly targets management platforms, which already have visibility, access and administrative functions."

The four confirmed platforms exploited in zero-day campaigns were:

Versa Director — used to manage enterprise SD-WAN deployments. Volt Typhoon exploited a file upload vulnerability that Black Lotus Labs publicly disclosed in August 2024 as CVE-2024-39717. After exploitation, the group deployed an in-memory Java webshell to minimize forensic artifacts while using the platform's built-in features to reach downstream customers.

N-Able N-Central — a remote monitoring and management platform used by managed service providers to administer thousands of customer endpoints. Volt Typhoon exploited two previously undisclosed vulnerabilities before a patch was issued in N-central release 2025.3.1: CVE-2025-8875 (an insecure deserialization flaw) and CVE-2025-8876 (a command injection flaw), both documented in the N-central 2025.3.1 release notes .

Cisco Catalyst SD-WAN Controller — a control plane platform for enterprise and carrier SD-WAN deployments. Volt Typhoon exploited an authentication bypass vulnerability rated critical at CVSS 10.0 that Cisco disclosed in February 2026 as CVE-2026-20127 — and continued exploiting after the disclosure, underscoring the group's sustained interest in maintaining access through known-patched vulnerabilities.

Arista VeloCloud Orchestrator — a centralized SD-WAN controller that Black Lotus Labs identified as the third SD-WAN platform Volt Typhoon exploited after Versa Director and Cisco Catalyst. The group exploited an OS command injection vulnerability (CVE-2026-16812) disclosed in the Arista security advisory 0144 .

In addition to these four confirmed campaigns, Volt Typhoon is assessed with moderate confidence to have exploited a fifth zero-day in Quest KACE, a unified endpoint management suite, before Quest issued a patch in October 2025 security updates . That campaign affected more than 30 confirmed victims.

Hundreds of Victims, Three States, One Strategic Map

Black Lotus Labs tracked Silent Train targeting over more than three years, identifying hundreds of victims across US government agencies, defense contractors, telecommunications providers, satellite and mission-critical communications services, universities with ROTC programs and military research affiliations, managed service providers, and critical infrastructure operators. Full victim sector analysis is available in the Silent Train framework report .

The geographic pattern is not random. Hawaii, California, and Texas emerged consistently as the most targeted states — a concentration that aligns with where the US military has its largest Pacific-facing installations, where defense contractors supporting Indo-Pacific logistics are concentrated, where satellite communications providers operate ground infrastructure, and where telecommunications backbone capacity crosses between the continental US and Pacific theater, as Kim Zetter reported in her Zero Day investigation .

The targeting is not purely pre-positioning, according to Horka. "We have seen them exfiltrating documents related to military operations and structures of networks and getting credentials that can get them long-term access," he told Zero Day. "I don't think they are just trying to preposition or espionage; I think it's a combination of the two."

That assessment sits uncomfortably alongside the December 2024 revelation, reported by the Wall Street Journal, that Chinese officials at a Geneva meeting with outgoing Biden administration representatives acknowledged the Volt Typhoon activity indirectly — framing it as a signal what Beijing views as an unacceptable level of US support for Taiwan. The implication, if the account is accurate, is that Silent Train's victims are not incidental infrastructure. They are selected leverage.

Silent Train After the KV-Botnet Takedown

The timing of Silent Train's emergence matters for understanding what it represents. Black Lotus Labs first detected consistent Silent Train activity in November 2023 — just weeks before the FBI's court-authorized KV-Botnet disruption in early January 2024. When the KV-Botnet takedown occurred, Silent Train was already operational and ready to absorb the load. Activity surged in the weeks following the disruption.

The KV-Botnet relied on a persistent, centralized infrastructure that defenders could identify over time and disrupt in a single coordinated operation. Silent Train was built specifically to remove that vulnerability. There is no persistent network to identify. There is no stable command-and-control infrastructure to null-route. There is only a framework for rapidly assembling and discarding chains — and the trained operators who can rebuild those chains within two minutes on demand.

Multiple operational models — SSH chains, reverse tunnels, semi-persistent enterprise hops, and hybrid combinations — now operate in parallel, expanding the framework's complexity rather than converging on a single detectable pattern.

What Can Organizations Actually Do

Black Lotus Labs' defender guidance is specific what security posture Silent Train reveals as inadequate and what remains useful.

The framework targets internet-facing management interfaces: SD-WAN controllers, endpoint management suites, out-of-band administration platforms. Organizations that expose these interfaces directly to the internet without additional access controls are the highest-risk population, as the Silent Train threat report details.

The specific recommendations are to restrict administrative interfaces behind VPNs, jump hosts, or dedicated management networks; to continuously inventory and minimize internet-facing systems; and to centralize logging with extended retention — because the only window defenders have to see Silent Train activity is the brief period during an active session, before cleanup occurs. CISA issued updated Volt Typhoon detection guidance in its joint advisory with the NSA and FBI, most recently updated in January 2026.

The hardest part of the defensive picture is that the framework is designed to fail gracefully under disruption. Volt Typhoon has demonstrated — after both KV-Botnet takedowns and now after Black Lotus Labs' three years of quiet disruption — that losing an infrastructure layer does not eliminate its access. The stolen credentials remain. The knowledge of victim network architectures persists. And the framework for rebuilding a chain is, as the research established, a matter of minutes.

Frequently Asked Questions

What is Silent Train, and how is it different from Volt Typhoon's hacking infrastructure?

Silent Train is a framework Volt Typhoon uses to build and then discard attack relay chains made of compromised routers, IoT devices, and enterprise platforms. Unlike the KV-Botnet, which maintained a persistent, reusable network of compromised SOHO devices that the FBI was able to identify and disrupt in January 2024, Silent Train chains are single-use — assembled in under two minutes, operated for an average of four hours, and then forensically erased. There is no stable infrastructure for defenders to locate between operations. This disposability is the core feature: it replaces a network that can be disrupted once with a framework that can reconstruct itself on demand.

What happens when someone's router or business device gets used in a Silent Train chain?

The owner or operator of the device almost certainly never knows. Silent Train operators exploit exposed web interfaces on SOHO and IoT devices to install temporary SSH services and keys, use the device as a relay node for a single session, and then remove all artifacts before leaving — restoring the device to its prior state. The device owner generates no alert and sees no evidence of the intrusion. This is what makes consumer-grade network equipment a persistent vulnerability even when it is not the intended target: it becomes infrastructure for attacks against defense contractors, utilities, and government networks without any action or awareness on the owner's part.

Which organizations are most at risk from Volt Typhoon's management platform targeting strategy?

Any organization that exposes an endpoint management suite (such as N-able N-central or Quest KACE), an SD-WAN controller (such as Cisco Catalyst or Arista VeloCloud Orchestrator), or similar control plane technology directly to the internet is in the highest-risk category. Managed service providers are particularly exposed because a single compromised management platform can give an attacker administrative access to all of that MSP's downstream customer environments — without requiring any further lateral movement. CISA's guidance specifically recommends restricting these administrative interfaces behind VPNs or dedicated management networks, prioritizing patching for all control plane technologies, and centralizing log retention to enable detection during the brief window when a Silent Train session is active.

Why does Volt Typhoon focus on Hawaii, California, and Texas?

Black Lotus Labs' three-year geographic mapping showed these three states as consistently the most targeted. The pattern aligns with strategic US assets concentrated in those regions: major military installations (including Pacific Command facilities in Hawaii), defense contractors and satellite communications providers supporting Indo-Pacific logistics, telecommunications backbone infrastructure connecting the continental US to the Pacific, and logistics networks that would be essential to any US response to a conflict in the region. US officials have assessed that Volt Typhoon is pre-positioning access that could be used to disrupt American command, control, and communications in the event of military confrontation over Taiwan — and the geographic pattern of Silent Train's victims is consistent with that assessment.