Volt Typhoon's Silent Train relay network disrupted after four zero-day campaigns

Disruption of a hidden relay network

Lumen's threat intelligence unit, Black Lotus Labs, has disclosed "Silent Train," a covert multi-hop access network active since late 2023 that it attributes to the China-linked group Volt Typhoon. According to the research, published by RedEye Threat Intelligence on dev.to, the network has been disrupted — but not before it carried at least four confirmed zero-day exploitation campaigns against management and orchestration products.

The victim count reached into the hundreds, spanning telecommunications providers, government bodies, defense contractors, satellite and emergency communications operators, universities, IT firms, and critical infrastructure across water, energy, transport, maritime, rail, aviation and emergency services.

The common thread was the target class. Volt Typhoon repeatedly went after the platforms that administer other systems: endpoint management, network management, SD-WAN controllers and orchestration layers. Compromising one instance of such a product yields visibility into, and often control over, every device or customer it manages.

The four campaigns

Black Lotus Labs tied four zero-days to operations run through Silent Train:

• CVE-2024-39717, a file upload vulnerability in Versa Director, previously linked to deployment of the VersaMem web shell for harvesting credentials and reaching downstream customers.
• CVE-2025-8875 and CVE-2025-8876, an insecure deserialization flaw and a command injection flaw in N-able N-central, a remote monitoring and management platform widely used by managed service providers.
• CVE-2026-20127, an authentication bypass in the Cisco Catalyst SD-WAN Controller.
• CVE-2026-16812, an operating system command injection flaw in the Arista VeloCloud Orchestrator.

The researchers also suspect a further zero-day in Quest KACE, patched in October 2025, was used against more than 30 victims. Vendor fixes exist for every named flaw, and applying them is the baseline mitigation.

How the relay chain worked

Silent Train was structured as a layered relay rather than a conventional botnet. Operator traffic passed through several compromised devices before reaching the victim, with each layer playing a defined role. Virtual private servers outside the US acted as throwaway staging points, provisioned for a single session and discarded. Compromised consumer and IoT devices outside the US, spread across countries, providers and hardware types, obscured where sessions originated. The final hop was a compromised device inside the US, which defeated geofencing and IP reputation filtering aimed at foreign source addresses.

At least 27 device classes were enrolled this way. Consumer and IoT brands included TP-Link, Intelbras, Ruckus Wireless, SATO, NETGEAR, Zyxel and Cambium, while enterprise products from Fortinet, Cisco, PRTG, Mirth Connect and CyberPanel also appeared in the relay pool.

What set the network apart from earlier Chinese relay infrastructure was its ephemerality. Rather than maintaining standing nodes, operators compromised exposed web interfaces on demand, deployed just enough tooling to chain SSH access through a device — temporary SSH services, keys, configuration files and built-in system utilities — and removed everything once the session ended. Black Lotus Labs characterizes the model as device chains exploited as needed, aimed at carefully chosen targets, cleaned up after each operation and continually refreshed. There was no persistent command-and-control server to sinkhole and no long-lived relay to fingerprint.

An answer to earlier takedowns

The timeline suggests the design was a direct response to losing prior infrastructure. Black Lotus Labs dates the first signs of the capability to around November 2023, weeks before the initial disruption of KV-botnet, an IoT botnet linked to several China-nexus actors including Volt Typhoon. After a second takedown in late January 2024, Silent Train activity grew sharply and settled into the disposable, diversified pattern the researchers documented. Takedowns of persistent botnets imposed costs on the actor; its adaptation was to eliminate the persistent component entirely.

Why it matters

Two conclusions from the research deserve attention from defenders. First, Volt Typhoon is spending zero-days specifically on management-plane products, repeatedly, across at least five vendors. Organizations that run these platforms — and the MSPs that run them on behalf of customers — are deliberate priority targets rather than incidental ones.

Second, infrastructure-based detection is losing ground against this tradecraft. When the last hop is a compromised device inside the US and the relay chain disappears after one session, source IP reputation and geographic filters tell defenders almost nothing. The researchers argue visibility has to come from the platforms themselves: authentication events, configuration changes, newly created administrative accounts, unexpected file writes and outbound connections from the appliance.

Silent Train itself is disrupted, but the tradecraft behind it has been proven. Expect it to resurface on fresh infrastructure, and patch the named CVEs now — the window before a patch exists is precisely where this actor has chosen to operate four times over.