Summary
Lumen's Black Lotus Labs reported on October 28, 2026 that the China-nexus group Volt Typhoon operated a covert access network dubbed Silent Train, used for zero-day exploitation and strategic access. The network has since been disrupted.
How Silent Train Works
| Attribute | Detail |
|---|---|
| First identified | Late 2023 |
| Design | Rotating chains of compromised SOHO, IoT, and enterprise devices |
| Chain lifetime | Assembled and dismantled daily; rebuilt on new infrastructure in under two minutes |
| Path | VPS infrastructure outside the US, then hacked routers as relays |
| Relays | Intelbras modems overseas, Netgear Orbi devices as US hops |
Researchers say the deployment was partly driven by the FBI's disruption of the KV-Botnet.
Zero-Day Exploitation
Monitoring uncovered at least four confirmed zero-days and one likely, aimed at network and endpoint management and control-plane systems:
- Versa Director
- N-able N-Central
- Cisco Catalyst SD-WAN
- VeloCloud Orchestrator
More than 27 device classes were exploited or abused, from vendors including Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto Networks, ServiceNow, TP-Link, and Netgear.
Victims
Hundreds of victims were identified across telecoms, government, defense contractors, satellite and communications services, universities, IT firms, and critical infrastructure including water, energy, transportation, maritime, rail, aviation, and emergency services. Lumen's tracking led to hundreds of victim notifications.
Recommendations
- Patch SD-WAN orchestrators, RMM platforms, and management consoles first, and keep them off the public internet.
- Replace end-of-life SOHO routers and modems, and monitor edge devices for unexpected outbound or relay traffic.
- Hunt for long-dwell access on management-plane systems; rotating relays make IP-based blocking unreliable.
- See CISA advisory AA24-038A for background on Volt Typhoon tradecraft.