Volt Typhoon Used Silent Train in at Least Four Zero-Day Attacks

Chinese state-sponsored hacking group Volt Typhoon used a framework called Silent Train to conceal attacks, including at least four that exploited zero-day vulnerabilities, according to researchers at Black Lotus Labs.

Black Lotus Labs, the threat research division of communications company Lumen, says it tracked the framework for three years. Silent Train routes activity through chains of compromised devices used as relays. The operators route traffic through virtual private servers outside the United States, then through hacked devices before launching attacks.

The researchers say Intelbras modems served as overseas relays, while Netgear Orbi devices acted as hops in the United States. The attacks targeted edge and management infrastructure across sectors including telecommunications, government, defense, utilities, transportation and emergency services. California, Texas and Hawaii were the most targeted regions in Black Lotus Labs’ observations.

Operators exploit exposed web interfaces and install only the tools needed to create chained SSH access, the researchers said. Sessions typically lasted under 8 hours, after which operators removed their tools, keys and configuration files. By early 2025, the framework had shifted to a hybrid approach that also retained compromised enterprise systems for one to three months.

Black Lotus Labs says the FBI’s disruption of the KV-Botnet partly drove Silent Train’s deployment. The researchers describe the framework as reserved for high-value targets and careful, hands-on operations. They recommend restricting internet access to administrative interfaces, promptly patching vulnerabilities and monitoring unusual administrative activity.