Chinese state-sponsored hacking group Volt Typhoon has been using a relay framework, dubbed Silent Train, to mask the origin of attacks that include exploitation of at least four zero-day vulnerabilities, according to researchers at Black Lotus Labs, the threat research division of Lumen.

Black Lotus Labs says it has tracked Silent Train for three years. The group uses the framework selectively against high-value targets, cleans up infrastructure after each operation, and continuously refreshes its relay chain to avoid detection.

How the relay network works

Silent Train routes attacker traffic through VPS infrastructure located outside the United States, then through compromised devices such as routers that act as intermediate hops before reaching the final target. Researchers identified Intelbras modems serving as overseas relays and Netgear Orbi devices acting as hops inside the U.S.

Operators exploit exposed web interfaces on SOHO, IoT, and other relay devices, deploying only the minimal tooling needed, temporary SSH services, keys, configuration files, and living-off-the-land utilities, to enable chained access. Sessions typically last under 8 hours, after which all tooling is removed from the disposable relays. By early 2025, the framework had become hybrid, also retaining access to some compromised enterprise systems for one to three months.

Zero-days and targets

Monitoring of Silent Train activity surfaced exploitation of CVE-2026-16812 (VeloCloud Orchestrator), CVE-2026-20127 (Cisco Catalyst SD-WAN), CVE-2025-8875 and CVE-2025-8876 (N-able N-central), and CVE-2024-39717 (Versa Director), along with a suspected zero-day in Quest KACE.

Targeted sectors include telecommunications, government, defense contractors, education, utilities and critical infrastructure, satellite services, IT firms, MSPs, transportation, aviation, and emergency services. California, Texas, and Hawaii were the most targeted U.S. regions, suggesting a focus on Indo-Pacific strategic interests. Researchers believe Silent Train’s development was partly driven by the FBI’s disruption of the KV-Botnet, which Volt Typhoon previously used to evade detection.

Recommendations

  • Restrict internet exposure of administrative interfaces on management systems
  • Patch edge and SD-WAN infrastructure rapidly
  • Centralize logs with extended retention
  • Monitor for unusual administrative activity and review trusted partner connections
  • Follow CISA and NCSC guidance on Volt Typhoon