Chinese state-sponsored hacking group Volt Typhoon has been using a covert relay framework called Silent Train to route attacks through compromised devices, conceal the origin of its operations, and deploy zero-day exploits against high-value systems. Black Lotus Labs, the threat research division of telecommunications company Lumen, has tracked the activity for three years and confirmed that Volt Typhoon exploited at least four zero-day vulnerabilities against edge and management infrastructure.
The campaign has affected telecommunications companies, government agencies, defense contractors, educational institutions, utilities and other critical-infrastructure organizations, satellite service providers, IT companies, managed service providers, transportation and aviation organizations, and emergency services. Black Lotus Labs observed the highest concentration of targeted organizations in California, Texas, and Hawaii, suggesting a focus on Indo-Pacific issues.
Source: Black Lotus Labs
Volt Typhoon has previously targeted critical U.S. infrastructure, including communications, energy, transportation, and water systems. CISA has warned that the group seeks to establish access that could enable disruption during future crises or conflicts.
According to the researchers, the introduction of Silent Train was partly enabled by the FBI’s disruption of the KV botnet, which Volt Typhoon had used to evade detection while targeting critical U.S. infrastructure.
Source: Black Lotus Labs
How the Silent Train relay network works
Silent Train is a relay infrastructure made up of compromised devices that Volt Typhoon uses to hide the source of its attacks. Operators route activity through virtual private server infrastructure outside the United States, then pass through hacked devices such as routers that serve as intermediary relays before the final attack.
Black Lotus Labs identified an Intelbras modem operating as an overseas relay and a Netgear Orbi device acting as a hop within the United States.
Source: Black Lotus Labs
Volt Typhoon’s activity through Silent Train has included exploiting vulnerabilities, stealing credentials, exfiltrating data, and maintaining persistent remote access to compromised systems. Compromising edge and management platforms can give attackers extensive administrative control, allowing them to steal credentials, establish remote access, and reach downstream customers without the noisy lateral movement that could trigger detection.
Source: Black Lotus Labs
“To establish these sessions, its operators exploit exposed web interfaces on SOHO, IoT, and other relay devices and deploy only the tools necessary to enable chain SSH access through compromised nodes,” Black Lotus Labs explains in its report.
“This included temporary SSH services, keys, configuration files, and ‘living off the land’ utilities.”
After a session ends, usually within less than eight hours, the attacker removes all tools, keys, and configuration files from the temporary relay.
By early 2025, researchers found that the framework had become hybrid. Single-use relays were being used alongside compromised enterprise systems that attackers retained for one to three months.
Silent Train reserved for high-value operations
Black Lotus Labs believes Silent Train is reserved for high-value targets and sensitive, practical operations conducted during China Standard Time (CST). The use of zero-day vulnerabilities for these missions further supports that assessment.
The researchers recommend strengthening security around central management systems, restricting internet access to management interfaces, rapidly remediating vulnerabilities, and centralizing logs for long-term storage.
They also advise organizations to monitor for anomalous administrative activity, review trusted connections that could expose customer or partner networks, and follow CISA and NCSC guidance on Volt Typhoon.
The overall prevention score can hide what happens after initial access. If an attacker uses valid credentials, your defenses can drop sharply.
The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com