"Volt Typhoon demonstrated a repeatable capability to rebuild a new chain with different infrastructure in less than two minutes, making the number of nodes at any one moment effectively close to zero," Michael Horka, principal information security engineer at Black Lotus Labs, told CyberScoop.
Michael Horka on Volt Typhoon’s repeatable capability
That observation sits at the center of a Wednesday report from Lumen Technologies’ Black Lotus Labs, which traces a sustained, covert access operation researchers have named "Silent Train." Black Lotus Labs says Silent Train is not a single, persistent botnet but a methodical practice of assembling and dismantling short-lived chains of compromised devices — a discipline that prioritizes operational security over scale. Horka, the lead researcher on the report, described sessions that average roughly four hours, rapid cleanup and compartmentalization, and continued development of new access vectors.
Silent Train: ephemeral chains of compromised devices
Black Lotus Labs describes Silent Train as a sequence of compromised small office/home office (SOHO) routers, internet of things (IoT) devices and enterprise infrastructure that Volt Typhoon has rotated through since late 2023. Individual chains, the report says, "are assembled and dismantled every day, with infrastructure continually refreshed." Researchers observed chains rebuilt in under two minutes and emphasized that the ephemeral, rapidly changing nature of the infrastructure means the number of nodes visible at any single moment is effectively near zero.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleVictimology: sectors and organizations notified
Black Lotus Labs has notified hundreds of victims after identifying Silent Train activity. The report lists notified organizations across multiple sectors, including:
- telecom providers, government entities and defense contractors;
- communication services, universities and IT firms;
- critical infrastructure organizations in water, energy, transportation, maritime, rail, aviation and emergency services.
The researchers wrote that the "exploitation patterns, victimology, and geographic targeting observed throughout our investigation point to a sustained focus on communications, defense, government, and critical infrastructure environments of enduring strategic value." The report cautions that Silent Train’s ephemerality means observed activity should not be interpreted as a complete census of Volt Typhoon operations.
Technology footprint: vendors, zero-days, and 27+ device classes
Silent Train’s reach, Black Lotus Labs reports, spans more than 27 device classes and includes edge devices, enterprise management tools, identity and access management systems, networking infrastructure and control-plane technologies. The group has successfully compromised devices and technologies from a broad set of vendors named in the report:
- Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto Networks;
- ServiceNow, TP-Link, Netgear, and ArcGIS.
Black Lotus Labs also confirmed zero-day exploitation campaigns targeting specific platforms: Versa Director, N‑Able N‑Central, Cisco Catalyst SD‑WAN and VeloCloud Orchestrator. The researchers emphasized that particular device types were consistently reserved for specific positions in a chain, meaning the operation "operated less like a collection of randomly compromised devices and more like an organized inventory of capabilities."
What this means for telecom providers, government entities, and defense contractors
- Telecom providers — The report’s focus on communications systems and the confirmed exploitation of control-plane technologies underscores a need to treat central management platforms as high-risk targets; Black Lotus Labs has already notified telecom victims and observed repeat targeting of centralized management tools.
- Government entities — The sustained targeting of government and defense-oriented networks indicates that ephemeral compromise chains can provide persistent access without a lasting, visible footprint in victim environments, complicating attribution and remediation.
- Defense contractors — Because Silent Train mixes enterprise management tools, networking infrastructure and identity systems, defense contractors should expect adversaries to seek footholds through both edge devices and centralized platforms that can be abused to broaden access.
Black Lotus Labs also linked Silent Train’s increased prominence to broader shifts earlier this year, saying Volt Typhoon relied more heavily on Silent Train after the FBI and Justice Department disrupted the KV Botnet in early 2024, and noting that U.S. and global authorities had warned about a move by Chinese hacking groups toward covert networks built on compromised common devices.
Horka framed the operational challenge bluntly: Silent Train is "fundamentally difficult to disrupt because there isn’t one network to take down." Individual pieces can be removed, but the report concludes that "removing the actor’s ability to continuously rebuild them is a much harder problem to solve." As Black Lotus Labs continues to notify victims, the core tension remains visible — defenders can identify and remove discrete intrusions, but the actor’s disciplined, ephemeral approach keeps the broader access capability alive.
