Volt Typhoon ran four zero

Lumen Technologies' Black Lotus Labs uncovered Silent Train, a rotating chain of compromised routers, IoT gear, and enterprise appliances that Volt Typhoon used to hit hundreds of organizations with four confirmed zero-days. Attack sessions lasted four hours on average, and the operators stripped every tool before they left.

Lumen Technologies' Black Lotus Labs linked China-aligned Volt Typhoon to a covert access network called Silent Train that powered four confirmed zero-day campaigns against U.S. targets, the research team said in a report.

The network has operated since late 2023. It runs on rotating chains of compromised small-office/ -office routers, IoT devices, and enterprise hardware, and it exists to push victims' defenses out of the way.

"First identified in late 2023, Silent Train uses rotating chains of compromised SOHO, IoT, and enterprise infrastructure," Black Lotus Labs said. "It employs anti-forensic techniques, compartmentalized operations, and post-operation cleanup to minimize detection and attribution."

The team said the network handles four critical attack phases: vulnerability exploitation, credential access, data exfiltration, and continued access to victim environments.

Black Lotus Labs identified hundreds of victims across telecommunications providers, government agencies, defense contractors, satellite and mission-critical communication services, universities, IT firms, and critical infrastructure spanning water, energy, transportation, maritime, rail, aviation, and emergency services.

The network targets systems that unlock everything else

Two patterns define the victim list.

First, Volt Typhoon picked entities that could hand it scalable access to downstream customers, sensitive networks, or strategic programs. Second, it went after endpoint management platforms, network management systems, SD-WAN orchestrators, and control plane technologies. These are the consoles administrators use to push configuration and software to thousands of machines at once.

Volt Typhoon, tracked also as Bronze Silhouette, Insidious Taurus, UNC3236, Vanguard Panda, and Voltzite , has run against critical infrastructure since at least 2021, with communications, energy, transportation, and water systems in its sights.

Four zero-days routed through one system

Silent Train carried four separate zero-day campaigns. The first drew attention in 2024, when Volt Typhoon exploited a file upload flaw in Versa Director, CVE-2024-39717 , to drop a custom web shell called VersaMem that harvested credentials and opened access to downstream customers.

The three that followed:

CVE-2025-8875 and CVE-2025-8876 : insecure deserialization and command injection in N-able N-central.

CVE-2026-20127 : an authentication bypass in the Cisco Catalyst SD-WAN Controller.

CVE-2026-16812 : operating system command injection in the Arista VeloCloud Orchestrator.

Black Lotus Labs also flagged a likely fifth campaign: a zero-day in Quest KACE that the vendor patched in October 2025. The team estimates that campaign hit more than 30 victims.

A pattern sits under the list. Every product is a management plane, and every management plane reaches far past the single box it runs on.

Built for the hours after the botnet takedowns

Silent Train started taking shape around November 2023, weeks before the first disruption against KV-botnet, an IoT botnet tied to several China-nexus groups including Volt Typhoon. Activity surged after a second disruption in late January 2024, and the group swapped its persistent servers for disposable ones.

"Rather than continue using persistent infrastructure, Volt Typhoon shifted to a model using one-time-use chains of compromised devices that it could rebuild as needed," Black Lotus Labs said. "Volt Typhoon rapidly assembled and dismantled transient infrastructure, creating a resilient, secure, and compartmentalized framework that protected valuable access."

How traffic moves through the chain

Silent Train relays attack traffic across several hops before it reaches the victim, so victims and defenders see the last device in line rather than the operator.

The chain has three tiers:

Virtual private servers outside the United States serve as staging. Operators provision them for a session and discard them afterward.

Compromised SOHO and IoT devices in other countries, across different providers and hardware brands, hide where the attack started.

Compromised U.S. devices act as exit nodes that touch the domestic victim, slipping past geofencing rules and IP reputation blocklists.

At least 27 device classes have been enrolled. The list runs from consumer gear such as TP-Link, Intelbras, Ruckus Wireless, SATO, NETGEAR, Zyxel, and Cambium hardware to enterprise platforms including Fortinet, Cisco, PRTG, Mirth Connect, and CyberPanel.

Operators compromise exposed web interfaces on each relay, then install only what chained SSH access requires: temporary SSH services, keys, configuration files, and tools already present on the host. When a session ends, they remove every artifact and break the chain apart.

"Silent Train sessions lasted four hours on average, with some lasting only minutes," Black Lotus Labs said.

Each device keeps the same job

Certain hardware never leaves its position in the chain. Intelbras modems appear only as relay nodes. Netgear Orbi and Fortinet FortiGate appliances sit at the U.S. end, where they talk to the victim.

Roles stay fixed while the machines behind them rotate. An analyst who catches one FortiGate exit node learns little the session, because the operators swap the rest of the chain around it.

Why Hawaii, California, and Texas

Inside the United States, Silent Train concentrated on Hawaii, California, and Texas. Those three states hold major military installations, telecommunications infrastructure, defense contractors, satellite communications providers, and logistics networks.

"Victimology indicates deliberate efforts to maintain access to critical ecosystems that support defense, logistics, communications, military and civilian operations, especially during heightened tensions or crises in the Indo-Pacific region," Black Lotus Labs said.

What defenders do it

The report hands defenders a clear set of priorities.

Treat management planes as internet-facing assets. Patch the SD-WAN controllers, endpoint management platforms, and orchestrators first, because one flaw on one console reaches every device the console manages. Check vendor advisories for the four CVEs above and run the CISA Known Exploited Vulnerabilities catalog against your inventory.

Stop trusting geofencing and IP reputation as a border. Silent Train exits through U.S. hardware on purpose, so a blocklist keyed to foreign addresses waves the traffic through.

Watch the management network for the artifacts operators leave while a session runs. New SSH services, unfamiliar authorized_keys entries, and fresh configuration files on network appliances show up in the hours before cleanup.

Segment the consoles. An orchestrator that can reach every branch device, every access point, and every firewall should sit behind jump hosts and administrative networks, not on the same flat network as staff.

Inventory the small-office routers and IoT gear at remote sites. Silent Train feeds on forgotten TP-Link and NETGEAR hardware that nobody patches.

Black Lotus Labs described the end result this way: "Through repeated targeting of centralized management platforms and control plane technologies, Silent Train shows how Volt Typhoon systematically pursues and preserves access to some of the most consequential networks in the United States."

The lesson for anyone running a distributed network: the boxes you use to administer everything are also the boxes an attacker wants most.

Source : thehackernews.com