Volt Typhoon Leveraged Covert 'Silent Train' Network for Four Zero-Day Exploitation Campaigns
Volt Typhoon, a China-nexus APT group, utilized a sophisticated, ephemeral network called 'Silent Train' to conduct multiple zero-day exploitation campaigns against critical infrastructure and strategic entities.
The China-linked Volt Typhoon advanced persistent threat (APT) group has been linked to a covert network infrastructure dubbed 'Silent Train,' which it employed for zero-day exploitation and to maintain strategic access to victim environments. First identified in late 2023, this network was designed to be ephemeral and rapidly reconfigurable, chaining together compromised SOHO, IoT, and enterprise devices to facilitate critical attack phases such as vulnerability exploitation, credential access, data exfiltration, and persistent access.
Lumen Technologies' Black Lotus Labs, which disrupted the operation, highlighted that Silent Train's primary objective was to target entities that could provide scalable access to downstream customers, sensitive networks, or strategic programs. The group specifically focused on endpoint management platforms, network management systems, SD-WAN orchestrators, and control plane technologies, which are pivotal to enterprise operations. This strategic targeting allowed Volt Typhoon to gain significant leverage within victim organizations.
The scope of Volt Typhoon's operations through Silent Train is extensive, with hundreds of victims identified across various sectors. These include telecommunications providers, government entities, defense contractors, satellite and mission-critical communication services, universities, IT firms, and critical infrastructure sectors such as water, energy, transportation, maritime, rail, aviation, and emergency services. The group, also known by aliases such as Bronze Silhouette and Insidious Taurus, has been active since at least 2021, with a known history of targeting critical infrastructure.
Black Lotus Labs confirmed that Silent Train was instrumental in at least four distinct zero-day exploitation campaigns. These campaigns leveraged previously unknown vulnerabilities in critical infrastructure and enterprise management software. Notably, the group exploited a file upload vulnerability in Versa Director (CVE-2024-39717) to deploy a custom web shell, VersaMem, for credential harvesting. Additionally, the campaigns exploited insecure deserialization and command injection flaws in N-able N-central (CVE-2025-8875 and CVE-2025-8876), an authentication bypass in Cisco Catalyst SD-WAN Controller (CVE-2026-20127), and an OS command injection in Arista VeloCloud Orchestrator (CVE-2026-16812).
Volt Typhoon also exploited a suspected zero-day vulnerability in Quest KACE before it was patched in October 2025, impacting over 30 victims. The Silent Train infrastructure is characterized by its rapid rotation of compromised devices, employing anti-forensic techniques, compartmentalized operations, and post-operation cleanup to minimize detection. This model allowed Volt Typhoon to conduct operations with high operational security, making attribution and disruption challenging.
The covert access capability began to take shape around November 2023, shortly before initial disruptions targeting the KV-botnet, an IoT botnet linked to Volt Typhoon. Activity surged after a second botnet disruption in late January 2024, with the group shifting to an ephemeral infrastructure composed of diverse device types across geographies. Instead of persistent infrastructure, Volt Typhoon adopted a model using one-time-use chains of compromised devices that could be rebuilt as needed, creating a resilient and secure framework.
Silent Train operates as a layered, multi-hop framework. Malicious traffic is relayed through several devices before reaching targets, obscuring the origin. This typically involves U.S.-based compromised devices acting as exit nodes to evade geofencing and IP reputation blocklists, non-U.S. compromised SOHO and IoT devices to conceal the attack's starting point, and virtual private servers (VPS) as temporary staging areas. At least 27 device classes, from consumer-grade routers to enterprise platforms from vendors like Fortinet and Cisco, were exploited and enrolled into this network.
The operational discipline of Silent Train, focusing on short-lived, self-managed sessions rather than persistent C2 infrastructure, sets it apart. Operators exploit exposed web interfaces on relay devices and deploy minimal tooling for chained SSH access. This approach, combined with the exploitation of zero-day vulnerabilities, underscores Volt Typhoon's sophisticated and adaptive tactics in targeting critical infrastructure and strategic entities.