Lumen’s Black Lotus Labs says the China-nexus group Volt Typhoon ran a covert access network, which the researchers call Silent Train, to launch at least four zero-day campaigns against organizations in telecommunications, government, defense and other sectors. The network, first identified in late 2023, is now described as disrupted, and Lumen has published indicators for defenders.
How the Silent Train Network Hid Volt Typhoon’s Operations
Silent Train is built from rotating chains of compromised small-office and home-office routers, IoT devices and enterprise devices. Operators exploited the devices on demand and cleaned them up after each operation. Traffic routes first through virtual private server infrastructure outside the US and then through hacked relays: Intelbras modems serve as overseas relays and Netgear Orbi devices as US hops.
Short Sessions and a Hybrid Model From 2025
Sessions typically lasted under eight hours, after which the operators removed tools, keys and configurations from the relays. By early 2025 the approach had turned hybrid, with the group retaining some enterprise systems for one to three months instead of clearing everything after each job.
Timing Against the KV-Botnet Disruptions
Silent Train took shape around November 2023, weeks before the first FBI disruption of the KV-Botnet. Activity surged after the second disruption in late January 2024, which suggests the operators built a replacement access layer as the earlier botnet came under pressure. That reading is an inference from the timing, not a conclusion Lumen states.
Four Zero-Day Campaigns Run Through the Network
Black Lotus Labs confirmed four zero-day campaigns that used Silent Train. One exploited the Versa Director file upload flaw CVE-2024-39717 and deployed the VersaMem web shell. Lumen also suspects Volt Typhoon used a likely zero-day in Quest KACE before the vendor’s October 2025 patch, an episode that affected more than 30 victims. The vendors have patched the four zero-days.
The group favored systems with broad enterprise visibility, meaning edge and management platforms that sit close to many other assets. Victims include telecommunications providers, government bodies, defense contractors, satellite services, universities, IT firms and managed service providers, utilities and transportation operators. Lumen counts hundreds of victims overall. The most-targeted US regions were California, Texas and Hawaii, which the researchers say points to an Indo-Pacific focus.
The Cisco SD-WAN Connection to CVE-2026-20127
Lumen reports that Volt Typhoon was exploiting Cisco’s CVE-2026-20127 by late 2025 and continued after Cisco disclosed the flaw in February. Separately, Cisco Talos said the infrastructure behind its KeyDrift findings, attributed to a cluster it calls UAT-11473, overlaps considerably with Silent Train. Talos does not say the two groups are the same, and Lumen does not tie its Cisco finding to KeyDrift. The details of the KeyDrift malware are covered in a companion article.
Why Pre-Positioned Access Remains the Central Concern
CISA has warned that Volt Typhoon seeks pre-positioned access that it could use to cause disruption during a future crisis. The Silent Train findings fit that description in an operational sense: an infrastructure designed to be disposable, regenerated after each session and rooted in consumer-grade hardware, gives the group access that is hard to trace to a single address or device.
Two features stand out from an analytical standpoint. First, the use of zero-days means that patch cadence alone would not have protected the earliest victims; defenders had no fix to apply until vendors learned of the flaws. Second, the choice of edge and management platforms rewards the attacker twice, because those systems both have wide reach and are poorly covered by endpoint tools.
The disruption of the network does not end the underlying capability. Lumen’s report documents how quickly Silent Train re-formed after the KV-Botnet takedowns, and the shift to retaining enterprise systems for months suggests the operators were willing to trade some stealth for persistence. Whether a successor network is already forming is not addressed in the published findings.
