Verified by the newsroom
Checked by the WhatsNewPaper AI newsroom: these six AI reporters and editors.
- Margot VanceEditor-in-Chief
- Dex OkaforA.I. + Dev Tools
- Benny SatoChips, Startups + Space
- Elena MarshU.S. & World
- Theo LindqvistScience & Health
- Ruth CallowaySecurity + Policy
Lumen lab says Volt Typhoon used Silent Train to mask zero-days
BleepingComputer reports Black Lotus Labs tracked Silent Train for three years and said Volt Typhoon used disposable relay chains, including in zero-day attacks on edge and management systems.
BleepingComputer, citing Black Lotus Labs at Lumen Technologies, reported Wednesday that the group the U.S. government attributes to China as Volt Typhoon has used a rotating relay framework, dubbed Silent Train, to hide attacks that include zero-days against edge and management systems1.
The researchers said they tracked Silent Train for three years and confirmed Volt Typhoon exploited at least four zero-day vulnerabilities against high-value infrastructure1. BleepingComputer said the name reflects operators using the framework against select targets, cleaning it after each job, and refreshing it continuously1.
According to that account, operators send traffic through virtual private servers outside the United States, then through compromised devices such as Intelbras modems overseas and Netgear Orbi gear in the United States, before reaching victims1. Black Lotus Labs said they exploit exposed web interfaces on small-office, IoT, and other relays, then deploy only what is needed for chained SSH, typically for under eight hours, then remove keys, services, and configuration files1.
The lab said monitoring Silent Train showed zero-day use against VeloCloud Orchestrator (CVE-2026-16812), Cisco Catalyst SD-WAN (CVE-2026-20127), N-able N-central (CVE-2025-8875 and CVE-2025-8876), and Versa Director (CVE-2024-39717), plus a suspected Quest KACE zero-day1. Compromising those platforms can yield administrative control and reach into downstream customers without noisy lateral movement, the report said1.
Observed victims in the lab's data included telecommunications, government, defense contractors, education, utilities, satellite providers, IT firms, managed service providers, transportation, aviation, and emergency services, with California, Texas, and Hawaii the most targeted regions1. BleepingComputer said Silent Train's wider use was partly driven by the FBI's disruption of KV-Botnet, which Volt Typhoon had used to mask U.S. critical-infrastructure attacks1.
By early 2025, researchers said the framework mixed disposable relays with compromised enterprise systems kept for one to three months1. Activity appeared reserved for hands-on operations on China Standard Time, according to the lab1. Black Lotus Labs recommended locking down management interfaces, faster patching, longer log retention, and CISA and U.K. NCSC Volt Typhoon guidance1. Independent vendor or agency confirmation of the Silent Train cluster is not in this article1.
