"Silent Train is built around rapidly rotating chains of compromised SOHO, IoT, and enterprise devices that are exploited on demand, used against carefully selected targets, cleaned up after each operation, and continuously refreshed," Lumen Technologies Black Lotus Labs said.
What Silent Train is and how Volt Typhoon used it
Black Lotus Labs attributes a covert access network called Silent Train to the China-nexus cyber espionage group known as Volt Typhoon (also tracked as Bronze Silhouette, Insidious Taurus, UNC3236, Vanguard Panda, and Voltzite). According to the report, Silent Train was designed to give operators transient, compartmentalized access to victim environments and to support critical attack phases — vulnerability exploitation, credential access, data exfiltration, and sustained access to downstream targets.
The framework is described as a "layered, multi-hop" relay designed to obscure origins: temporary virtual private servers (VPS) outside the U.S., chains of non-U.S. SOHO and IoT devices, and U.S.-based compromised devices serving as exit nodes. Black Lotus Labs says the network emphasizes short-lived sessions, with an average session length of about four hours and some lasting only minutes, and that operators removed artifacts and dismantled chains after operations to minimize detection and attribution.
Four confirmed zero-day campaigns (and a suspected fifth)
Black Lotus Labs links Silent Train to four confirmed zero-day exploitation campaigns that Volt Typhoon used to gain strategic access:
- CVE-2024-39717 — a file upload vulnerability in Versa Director used to deliver a bespoke web shell, VersaMem, which harvested credentials and enabled downstream customer access.
- CVE-2025-8875 and CVE-2025-8876 — insecure deserialization and command injection vulnerabilities in N-able N-central.
- CVE-2026-20127 — an authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller.
- CVE-2026-16812 — an operating system command injection vulnerability in Arista VeloCloud Orchestrator.
Separately, Black Lotus Labs says Volt Typhoon is suspected of exploiting a likely zero-day in Quest KACE before it was patched in October 2025; that campaign is estimated to have impacted more than 30 victims.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageVictimology: who was targeted
Black Lotus Labs identified hundreds of victims across a wide set of sectors: telecommunications providers, government, defense contractors, satellite and mission‑critical communications services, universities, IT firms, and critical infrastructure operators — including water, energy, transportation, maritime, rail, aviation, and emergency services. The activity repeatedly targeted centralized and network-wide management technologies: endpoint management platforms, network management systems, SD‑WAN orchestrators, and control-plane technologies.
Operational timeline and technical evolution
Silent Train began to take shape around November 2023 and expanded after the second disruption of the KV‑botnet in late January 2024, Black Lotus Labs reports. Initially built around fully ephemeral chains that were rebuilt for each session, the platform evolved by early 2025 into a hybrid architecture that sometimes retained enterprise-grade devices for one to three months. Later variants introduced reverse-tunnel tooling using open-source proxies such as Chisel and FRP.
Black Lotus Labs cataloged exploitation across at least 27 device classes — from consumer SOHO and IoT vendors such as TP‑Link, Intelbras, Ruckus Wireless, SATO, NETGEAR, Zyxel, and Cambium to enterprise platforms including Fortinet, Cisco, PRTG, Mirth Connect, and CyberPanel. Some device types were assigned specific roles inside chains (for example, Intelbras modems appearing as relay nodes only, while Netgear Orbi and Fortinet FortiGate appliances functioned as U.S.-based intermediary and exit points).
Within the United States, the report highlights Hawaii, California, and Texas as focus areas for Silent Train operations — states that host major military installations, telecommunications infrastructure, defense contractors, satellite communications providers, and critical logistics networks.
What this means for technologists, procurement leaders, and policymakers
- Technologists and security teams: the report underscores the need to prioritize monitoring and hardening of centralized management consoles and control-plane technologies named in the campaigns, to audit for short‑lived SSH services and unexpected reverse tunnels, and to watch for transient, compartmentalized chains of compromised devices.
- Procurement and IT leaders at telecoms, defense contractors, and critical infrastructure operators: Black Lotus Labs' findings highlight exposure that can come through endpoint management and network orchestration platforms — vendors and patch timelines for products such as Versa Director, N‑able N‑central, Cisco Catalyst SD‑WAN Controller, Arista VeloCloud Orchestrator, and Quest KACE are directly implicated.
- Policymakers and infrastructure overseers: the targeting pattern — repeated focus on systems that provide broad visibility and control across enterprise environments — points to the strategic aim of preserving access at scale, especially during heightened Indo‑Pacific tensions, and may inform priorities for oversight and incident response coordination.
Silent Train, as described by Black Lotus Labs, demonstrates an operational model built not for persistence in a single location but for resilient, transient access that can be reconstructed as needed. That design both complicates detection and raises a clear, concrete challenge: defenders must track rapid, ephemeral chains of access across dozens of device types and prioritize protections around the central management technologies the campaigns exploited.
