Volt Typhoon Silent Train Framework Hides Zero-Day Attacks

Chinese state-sponsored group Volt Typhoon is using a relay framework called Silent Train to hide its attacks, including zero-day exploits against high-value systems. Researchers at Black Lotus Labs (Lumen) say the group exploited at least four zero-day vulnerabilities in edge and management infrastructure. If you run SD-WAN, remote management, or patch tooling, read the checks below. BleepingComputer reported the findings on October 28, 2026.

What Silent Train is and how the relay chain works

Silent Train is a relay network made of compromised devices. Operators route activity through VPS infrastructure outside the United States. Then they pass it through hacked devices such as routers before launching attacks.

Black Lotus Labs says Intelbras modems served as overseas relays. Netgear Orbi devices acted as hops in the U.S.

The name comes from how the group uses it. Volt Typhoon applies it to select targets, cleans it up after each operation, and refreshes it continuously. Researchers have tracked it for three years.

Its deployment was partly driven by the FBI's disruption of KV-Botnet, which Volt Typhoon previously used to evade detection when attacking U.S. critical infrastructure.

The operators exploit exposed web interfaces on SOHO, IoT, and other relay devices. Then they deploy only what they need for chained SSH access through the compromised node. That included temporary SSH services, keys, configuration files, and "live off the land" utilities.

Sessions typically end in under 8 hours. After that, the actors remove their tooling, keys, and configuration files from the disposable relays.

By early 2025, the framework had become hybrid. It used disposable relays alongside compromised enterprise systems that were kept for one to three months.

Which products and organizations are affected

Black Lotus Labs saw zero-day exploits for these products while monitoring Silent Train:

These platforms give attackers broad administrative control. That means credential theft, remote access, and reach into downstream customers, without the noisy lateral movement that might trigger detection. MSPs and IT firms are exposed twice: through their own tools and through their customers' networks.

Targeted sectors include:

• Telecommunication firms and satellite service providers

• Government agencies and defense contractors

• Utilities and other critical infrastructure

• Educational institutes, IT firms, and MSPs

• Transportation, aviation, and emergency services

The most targeted regions are California, Texas, and Hawaii. Researchers read that as a focus on Indo-Pacific matters. Check each vendor's advisory for the fixed version of your product, since the report does not list them.

How serious this is

This is serious for anyone who runs the products above. The flaws were exploited in the wild, and at least four were zero-days when first used. That means patches did not exist when the attacks began.

The group's intent adds weight. CISA has warned that Volt Typhoon targeted U.S. communications, energy, transportation, and water systems. The goal is access for potential disruption during a future crisis or conflict.

Black Lotus Labs believes Silent Train is reserved for high-value targets. Operators work hands-on, on China Standard Time (CST). A small office with no link to those sectors is a less likely target. Still, your hacked router could serve as a relay for someone else's attack.

The design also makes detection hard. Traffic arrives from ordinary-looking devices in the U.S., and the tooling disappears within hours. Your logs may be the only evidence left.

What to do now

Start with exposure, then patching, then log review.

1. Patch. Apply vendor fixes for every product in the table above that you run. Check each vendor's advisory for the fixed version.

2. Remove internet access to admin interfaces. Put SD-WAN controllers, N-central, Versa Director, and KACE behind a VPN or an allow list.

3. Centralize logs and extend retention. Sessions can end in under 8 hours, so you need history to see them.

4. Review trusted connections. Look for links that could expose customer or partner networks.

5. Follow CISA and NCSC guidance on Volt Typhoon.

To see what the internet sees, scan your public ranges from outside your network. Replace the placeholder with your own range:

nmap -Pn -p 22,443,8443 --open YOUR_PUBLIC_IP_RANGE

On Linux management servers where you have shell access, look for access that someone kept in place. The report says compromised enterprise systems were retained for one to three months, so the key search below covers 90 days. The SSH listener check uses grep -i ssh because a temporary SSH service may not listen on port 22.

ss -tlnp | grep -i ssh
find / -name authorized_keys -mtime -90 2>/dev/null
grep -E "Accepted (publickey|password)" /var/log/auth.log | tail -n 100
last -i | head -50

On systemd hosts without /var/log/auth.log, use this instead. It covers distros that name the unit ssh and those that name it sshd:

journalctl -u ssh -u sshd --since "30 days ago" | grep Accepted

A worked example

Say your auth log shows an Accepted publickey login to your management server. The source address is a residential-looking U.S. IP, and the session lasted three hours. Nobody on your team owns that key.

Treat it as a possible relay hop. Record the key fingerprint and the source IP. Then check whether the key still exists in authorized_keys, and compare the timing against your admin change records.

Next, convert the login time to China Standard Time (UTC+8). Black Lotus Labs says operators work hands-on on CST, so a cluster of odd sessions during CST working hours adds weight. It is a clue, not proof. If the session matches no change record, isolate the host and escalate.

Also watch for unusual administrative activity on the controllers themselves. New admin accounts, new API tokens, and config exports outside change windows all belong on that list. For related edge-device guidance, see our posts on the Cisco Secure Firewall ASA and FTD flaw and the Ivanti Connect Secure vulnerability.

What IT and security learners can take from this

This story shows why exam topics like network segmentation, least privilege, and log management matter in real work. Management planes are high-value targets, and attackers often use trusted tools instead of malware. Practice reading auth logs and thinking in attack chains. If you are building toward a security role, our Cybersecurity certification page lists the exam vouchers we sell, and codes arrive by email within 12 hours.

Sources

• Volt Typhoon hides zero-day attacks using 'Silent Train' framework (BleepingComputer)