New research from Lumen Technologies’ Black Lotus Labs detailed how China-linked cyber threat group Volt Typhoon used a covert operational framework, dubbed Silent Train, to exploit zero-day vulnerabilities and maintain strategic access to U.S. critical infrastructure and other strategically significant organizations. Tracked for more than three years and first identified in November 2023, Silent Train uses rapidly rotating chains of compromised small office/home office (SOHO), Internet of Things (IoT), and enterprise devices to conceal malicious activity, complicate attribution and reduce the likelihood of detection.
Black Lotus Labs said its monitoring resulted in hundreds of victim notifications and investigations that uncovered four confirmed and one likely zero-day campaigns targeting network and endpoint management systems, software-defined wide area network (SD-WAN) orchestrators and other centralized control plane technologies. Victims included telecommunications providers, government agencies, defense contractors, satellite communications providers, managed service providers and critical infrastructure organizations across water, energy, transportation, maritime, rail, aviation and emergency services.
The Silent Train framework routes malicious activity through multiple intermediary systems, including virtual private servers and compromised devices outside and inside the U.S., before reaching targeted organizations. Black Lotus Labs observed more than 27 device classes used in these operations, including TP-Link routers, Netgear Orbi devices and Fortinet appliances.
Attackers exploited exposed web interfaces, established temporary SSH connections or reverse tunnels, and removed operational artifacts after completing sessions to limit forensic evidence. The framework increasingly incorporated enterprise platforms that could remain active for one to three months and provide access to multiple downstream systems.
Black Lotus Labs found that Volt Typhoon repeatedly targeted centralized management and control plane technologies because their administrative privileges and network visibility could provide access to large enterprise environments and connected customers. It recommended reducing internet exposure, prioritizing patches for management platforms, strengthening access controls, reviewing downstream permissions, and preserving security logs and telemetry to improve detection and limit the impact of such intrusions.
“Over three years, we notified hundreds of victims in key sectors and supported investigations that uncovered at least one likely and four confirmed zero-day campaigns targeting endpoint and network management systems, SD-WAN, out-of-band platforms and other control plane infrastructure,” researchers from Black Lotus Labs wrote in the recent blog post. “A consistent pattern emerged: Volt Typhoon repeatedly targets systems that, once breached, offer extensive visibility, control and access across large enterprise environments.”
They added that Hawaii, California and Texas consistently emerged as the most targeted regions, reflecting a sustained focus on communications, logistics, defense and critical infrastructure ecosystems that support strategically significant U.S. operations, particularly in the Indo-Pacific region.
Silent Train is a layered, multi-hop framework that lets Volt Typhoon operators route activity through several devices before reaching their targets. Simple in concept, it proved disciplined in practice: telemetry from the global IP backbone showed rapid infrastructure rotation, deliberate compartmentalization, and structured workflows that stayed consistent even as the underlying infrastructure changed frequently.
The architecture relies on a chain of intermediary hops that shields the attacker from both victims and threat hunters. Sessions start on disposable virtual private servers outside the U.S., pass through a second VPS that adds geographic and provider diversity, then move across compromised non-U.S. SOHO and IoT devices that obscure the true origin. The chain ends at compromised U.S.-based devices that serve as a domestic exit point, helping malicious traffic blend in and evade geo-blocking and IP reputation filters. Together, these layers compartmentalize operations, hinder attribution, and make the full chain difficult to trace.
“Silent Train stands out for its operational discipline, focusing on short-lived, self-managed sessions rather than persistent relays or C2 infrastructure,” the researchers observed. “To construct these sessions, its operators exploit exposed web interfaces on SOHO, IoT and other relay devices, then deploy only the tooling needed to enable chained SSH access through the compromised node. This included temporary SSH services, keys, configuration files and ‘live off the land’ utilities. At the end of each session, operators removed all artifacts and dismantled the chain. Sessions averaged about four hours, though some lasted only minutes.”
Volt Typhoon assigned specific device types to fixed positions within Silent Train chains and never deviated from those roles over the three-year observation period. Intelbras modems appeared only as overseas relay nodes, while Netgear Orbi devices served as the U.S.-based hops that interacted with victims, and similar patterns held across every other device type. This was despite the group having enough global infrastructure to swap device types between overseas and U.S. positions. Its VPS infrastructure followed the same logic, using separate providers and locations rather than a shared environment. The pattern points to deliberate compartmentalization across layers, which complicates attribution and limits how much of the network is exposed if one device or provider is compromised.
Interestingly, the infrastructure itself kept evolving even as this structure held firm. Early operations relied on quickly rotating SOHO and IoT devices such as TP-Link, Intelbras, Ruckus, SATO, Netgear, Zyxel and Cambium, which were exploited through exposed web interfaces for a single session and then restored to a pre-operational state through extensive cleanup. Over time, the group added enterprise-grade platforms including Fortinet, Cisco, PRTG, Mirth Connect and CyberPanel. These did not replace the standard array but instead served as optional end-of-chain layers or took the place of the final U.S. relay node, producing a hybrid model.
Unlike the short-lived SOHO and IoT devices used for single operations, compromised enterprise platforms stayed active in Silent Train for one to three months and supported multiple intrusions before being replaced. By early 2025, this shift had turned Silent Train into a hybrid framework that kept its compartmentalization and resistance to attribution while gaining stability from longer-lived final-hop infrastructure, with as many as six hops separating the operator from the victim in some cases.
“As Silent Train matured, reverse-tunnel variants were introduced alongside the traditional SSH-chaining model,” the researchers noted. “Rather than exposing temporary SSH services on each hop and pivoting sequentially through the chain, some operations mixed in reverse tunnels via open-source proxies like Chisel and FRP, sending traffic from compromised devices to upstream infrastructure.”
Silent Train differed fundamentally from the infrastructure Volt Typhoon used for target development and early reconnaissance, which ran over additional operational relay box (ORB) networks and ad-hoc infrastructure. Silent Train was reserved for critical phases such as exploitation, credential access, data exfiltration and ongoing engagement with victim environments. Sessions were highly selective, involving one to five victims but often focusing on a single organization. The targets were entities that could provide scalable access to downstream customers, sensitive networks or strategic programs, indicating deliberate, strategic victimology rather than random selection.
Session timing shows that people, not automation, operated Silent Train. Activity clustered Monday through Friday, mostly between 09:00 and 22:00 China Standard Time, with little overnight or weekend activity. Spikes in late morning, mid-afternoon and evening suggest a structured tempo consistent with military rotational work schedules in China, and session activity dropped for several weeks during the Chinese New Year. Together with the selective targets and disposable chains, this indicates Volt Typhoon kept Silent Train for carefully chosen missions, as the zero-day campaigns demonstrated.
Through Silent Train, Black Lotus Labs observed Volt Typhoon target a broad range of edge, identity, network and enterprise management technologies, including Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto, ServiceNow and ArcGIS.
Telemetry could not always show whether access relied on known or undisclosed vulnerabilities, but the group consistently went after systems with critical administrative, trust and networking functions. More specifically, it focused on endpoint and network management platforms, SD-WAN orchestrators and other enterprise control plane technologies, which act as centralized trust points giving enterprises and their downstream customers broad administrative access, asset visibility and remote management capabilities.
Compromising these platforms offers clear operational benefits. Rather than traversing networks, identifying administrators and establishing multiple footholds, Volt Typhoon can tap platforms that already hold visibility, access and administrative functions. This widens the scope of access while reducing host interactions and authentication events and minimizing forensic artifacts, effectively delivering the reach of a full intrusion with no lateral movement. Persistent monitoring of Silent Train gave Black Lotus Labs rare visibility into this exploitation, often before public disclosures, vendor alerts or incident response, and helped identify one likely and four confirmed zero-day campaigns targeting network and endpoint management platforms and SD-WAN orchestrators used by critical organizations.
Black Lotus Labs’ persistent monitoring of Silent Train provides one of the clearest views into how Volt Typhoon conducts and protects their most sensitive intrusion operations. What began as an investigation into unusual SSH relay chains ultimately exposed a mature operational framework supporting years of targeted exploitation against strategically significant organizations across the U.S.
Although the technologies, vulnerabilities and victims varied, the objective remained the same: secure lasting access to systems and organizations offering broad visibility, administrative control and reach into larger operational ecosystems. Exploitation patterns, victimology and geographic targeting reveal a sustained focus on communications, defense, government and critical infrastructure of ‘enduring’ strategic value.
Management and control plane technologies give attackers broad visibility and administrative access across enterprise and customer environments, so organizations should secure them accordingly. That means applying heightened controls to network and endpoint management systems, SD-WAN orchestrators, out-of-band platforms and other centralized administration tools, and regularly reviewing the permissions, trust relationships and downstream access they grant.
Organizations should also continuously inventory and minimize internet-facing systems, administrative services and portals, restricting direct access to administrative interfaces through VPNs, access control policies, jump hosts or dedicated management networks. Patching should prioritize vulnerabilities in centralized management and control plane technologies, backed by rapid remediation processes for all internet-facing administrative platforms.
Visibility and detection are the next layer. Organizations should centralize logging, extend retention and export security telemetry wherever possible, with particular attention to internet-facing systems and platforms that enable elevated administrative access. Defenders should hunt for abuse of trusted platforms by investigating unusual administrative logins, abnormal API usage, remote file transfers, configuration changes and network or endpoint administration activity, as well as suspicious ‘live off the land’ behavior that falls outside normal administrative timeframes or workflows. Implementing CISA and NCSC guidance to mitigate Volt Typhoon activity and defend against China-nexus covert networks of compromised devices is also advised.
Finally, organizations should prepare for strategic targeting by assessing how their systems, services and trust relationships could give attackers access to broader customer, partner, government or critical infrastructure ecosystems. This is especially important for trust relationships within telecommunications, government, defense, MSP and critical infrastructure environments. Sophisticated nation-state actors should treat centralized management and control plane technologies as priority targets.
