Volt Typhoon hides zero-day attacks using 'Silent Train' framework

Chinese state-sponsored hacking group Volt Typhoon has been operating a framework that relies on rotating chains of connected devices compromised on demand, including to launch zero-day attacks against high-value systems. The framework has been dubbed Silent Train by researchers at Black Lotus Labs, the threat research division of communications company Lumen, because the threat actor deploys it against select targets, cleans it up after each operation, and refreshes it continuously. Black Lotus Labs has been tracking Silent Train for three years and says it confirmed that Volt Typhoon exploited at least four zero-day vulnerabilities in attacks targeting edge and management infrastructure. Victims identified by the researchers include telecommunication firms, government agencies, defense contractors, educational institutes, utilities and critical infrastructure operators, satellite service providers, IT firms, managed service providers, and organizations in transportation, aviation, and emergency services. Observations indicate the most targeted regions are California, Texas, and Hawaii, which the researchers suggest points to a focus on Indo-Pacific matters. Volt Typhoon has previously targeted U.S. critical infrastructure, including communications, energy, transportation, and water systems. The Cybersecurity and Infrastructure Security Agency (CISA) has warned that the group seeks to establish access for potential disruption during a future crisis or conflict. According to the researchers, Silent Train's deployment was partly fueled by the FBI's disruption of the KV-Botnet, a botnet Volt Typhoon previously used to evade detection when attacking critical infrastructure in the United States. Silent Train functions as relay infrastructure made of compromised devices that Volt Typhoon uses to hide the origin of its attacks. Operators route their activity through VPS infrastructure outside the United States, then pass it through hacked devices such as routers that act as intermediate relays before launching attacks. Black Lotus Labs says Intelbras modems served as overseas relays, while Netgear Orbi devices acted as hops within the U.S. The threat actor's use of Silent Train involves exploiting vulnerabilities, stealing credentials, exfiltrating data, and maintaining persistent remote access to compromised systems. By monitoring Silent Train activity, the researchers were able to observe zero-day exploits against several products, though the report did not enumerate the full list. Compromising these platforms gives the attackers broad administrative control, enabling credential theft, remote access, and reach into downstream customers without the noisy lateral movement that might trigger detection. To construct these sessions, operators exploit exposed web interfaces on SOHO, IoT, and other relay devices, then deploy only the tooling needed to enable chained SSH access through the compromised node. Black Lotus Labs says this included temporary SSH services, keys, configuration files, and living-off-the-land utilities. After a session ends, typically in under eight hours, the attackers remove all tooling, keys, and configuration files from the disposable relays. By early 2025, the researchers noticed that the framework had become hybrid, combining disposable relays with compromised enterprise systems that were retained between one and three months. Black Lotus Labs believes Silent Train was reserved for high-value targets and careful, hands-on operations conducted on China Standard Time, an assessment reinforced by the use of zero-days against those targets. The researchers recommend strengthening security around centralized management systems, restricting internet access to administrative interfaces, rapidly patching vulnerabilities, and centralizing logs with longer retention. They also advise monitoring for unusual administrative activity, reviewing trusted connections that could expose customer or partner networks, and following CISA and NCSC guidance on Volt Typhoon.