Volt Typhoon deployed disposable Silent Train relay network to conceal zero-day cyberattacks

State-sponsored hacking group Volt Typhoon has conducted zero-day attacks against high-value network management systems by routing traffic through a rotating framework dubbed Silent Train. Researchers at Black Lotus Labs, the threat intelligence unit of Lumen, revealed they tracked the network for three years as the threat actors targeted defense contractors, telecommunications firms, utilities, and emergency services. Cisco Talos also tied key-stealing malware targeting Cisco Catalyst SD-WAN to the same infrastructure. [1][2]

The framework functions as a temporary relay chain to disguise attack sources, routing operations through foreign virtual private servers, overseas Intelbras modems, and intermediate Netgear Orbi devices located in the United States. Silent Train enabled the exploitation of at least four zero-days, including CVE-2026-20127 in Cisco Catalyst SD-WAN, CVE-2026-16812 in VeloCloudOrchestrator, CVE-2024-39717 in Versa Director, and CVE-2025-8875 and CVE-2025-8876 in N-able N-central. Attackers relied on temporary SSH tools and live-off-the-land utilities, systematically wiping tooling and configuration files within eight hours, though by early 2025 the setup evolved to maintain select compromised enterprise nodes for one to three months. [2]

According to Black Lotus Labs, the adoption of Silent Train expanded following the FBI's disruption of Volt Typhoon's KV-Botnet. Activity concentrated heavily on targets in California, Texas, and Hawaii, indicating an emphasis on Indo-Pacific operations. Because these compromised centralized platforms provide wide administrative control and reach into downstream customers without noisy lateral movement, defenders are urged to restrict public internet exposure to administrative interfaces and rapidly patch edge infrastructure. [2]