Black Lotus Labs has tracked the Silent Train framework for three years and says Volt Typhoon exploited at least four zero-day vulnerabilities while using the framework to hit high-value targets.
Silent Train relay network
Silent Train is a relay infrastructure made of chained, compromised devices that Volt Typhoon uses to obscure where attacks begin. Black Lotus Labs describes operators routing activity through virtual private servers outside the United States and then passing it through hacked devices—routers and modems that act as intermediate relays—before launching operations. The researchers identified Intelbras modems serving as overseas relays and Netgear Orbi devices acting as hops inside the U.S.
The operators construct ephemeral sessions by exploiting exposed web interfaces on SOHO, IoT, and other relay devices and “deploy only the tooling needed to enable chained SSH access through the compromised node,” Black Lotus Labs reports. “This included temporary SSH services, keys, configuration files, and ‘live off the land’ utilities.” After most sessions—typically under eight hours—the tooling, keys, and configuration files are removed from the disposable relays.
Zero-day CVEs observed
By monitoring Silent Train activity, Black Lotus Labs observed zero-day exploits against multiple centralized management and edge platforms. The tracked vulnerabilities include:
- CVE-2026-16812 – VeloCloud Orchestrator
- CVE-2026-20127 – Cisco Catalyst SD-WAN
- CVE-2025-8875 and CVE-2025-8876 – N-able N-central
- CVE-2024-39717 – Versa Director
- Quest KACE (suspected zero-day)
Black Lotus Labs warns that compromising those platforms grants broad administrative control, enabling credential theft, persistent remote access, and reach into downstream customer networks without noisy lateral movement that might trigger detection.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageTargets, geography, and strategic focus
The researchers list a wide range of observed targets: telecommunication firms, government agencies, defense contractors, educational institutions, utilities and other critical infrastructure, satellite service providers, IT firms and managed service providers, transportation, aviation, and emergency services. Observations indicate the most targeted U.S. regions are California, Texas, and Hawaii—an emphasis the report says suggests a focus on Indo-Pacific matters.
Black Lotus Labs also links Silent Train’s rise in part to the FBI’s disruption of KV‑Botnet, which Volt Typhoon had used to evade detection in prior attacks on U.S. critical infrastructure. CISA previously warned that Volt Typhoon seeks to establish access to communications, energy, transportation, and water systems for potential disruption during a future crisis or conflict; the Silent Train framework appears tailored for selective, hands-on operations against high-value infrastructure.
Operational shifts: disposable relays to hybrid persistence
Researchers observed a shift in early 2025 from purely disposable relays to a hybrid model that combined short-lived relays with compromised enterprise systems retained for longer periods—between one and three months. That evolution suggests the framework was reserved for careful, hands-on operations usually conducted on China Standard Time (CST), according to Black Lotus Labs, and that the use of zero-days was concentrated against those select targets.
Black Lotus Labs’ timeline and procedures indicate an emphasis on minimizing forensic artifacts in relays and preserving quieter, credential‑based access into higher-value networks—conditions under which prevention metrics can fall sharply once an attacker is using valid administrative credentials.
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams: prioritize hardening and monitoring of centralized management systems and edge orchestration products named in the report; restrict internet access to administrative interfaces, centralize logs with longer retention, and watch for unusual administrative activity or trusted connections that could expose customer networks.
- Policymakers and regulators: the pattern of selective targeting and the use of zero-days against infrastructure management platforms reinforces guidance from CISA and NCSC; coordination around rapid patching and guidance for managed services and telecommunication providers will be critical.
- Affected enterprises and procurement leaders: vendors of orchestration and remote management platforms—explicitly those products listed in the report—should be treated as high-risk assets; enterprises should review trusted connections and downstream reach that an administrative compromise could expose.
Black Lotus Labs recommends rapid patching of exposed systems, tighter controls on administrative interfaces, and following CISA and NCSC guidance on Volt Typhoon. The Blue Report 2026—cited in the research note—measures defenses technique by technique across 338 million simulations run in customer production environments and underscores how prevention can be undermined once valid credentials are used.
Where Silent Train was once an ephemeral chain of disposable relays, it now mixes brief relays with retained enterprise footholds and focused zero-day use. That combination, the researchers conclude, makes the framework especially suited to hands-on operations against high-value targets—operations that are cleaned up after each job and refreshed continuously.
Source: BleepingComputer — Volt Typhoon hides zero-day attacks using 'Silent Train' framework
