Black Lotus Labs: Volt Typhoon used 'Silent Train' relay framework in zero-day attacks
Researchers at Black Lotus Labs, Lumen's threat research division, say they have tracked a Volt Typhoon framework called Silent Train for three years and that the group exploited at least four zero-day vulnerabilities against edge and management infrastructure. The framework routes attacks through rotating chains of compromised devices that are cleaned up after each operation.
What happened
- Black Lotus Labs said it tracked Silent Train for three years and that Volt Typhoon exploited at least four zero-day vulnerabilities in attacks on edge and management infrastructure.
- The researchers listed observed zero-day exploits for VeloCloud Orchestrator (CVE-2026-16812), Cisco Catalyst SD-WAN (CVE-2026-20127), N-able N-central (CVE-2025-8875 and CVE-2025-8876) and Versa Director (CVE-2024-39717), plus a suspected zero-day in Quest KACE.
- Silent Train is a relay infrastructure built from compromised devices: activity is routed through VPS infrastructure outside the United States and then through hacked devices such as routers before attacks are launched.
- According to the researchers, Intelbras modems served as overseas relays and Netgear Orbi devices acted as hops inside the U.S.
- Sessions typically ended in under eight hours, after which operators removed tooling, keys and configuration files from the disposable relays; by early 2025 the framework had become hybrid, mixing disposable relays with compromised enterprise systems retained for one to three months.
- Named targets include telecom firms, government agencies, defense contractors, utilities and critical infrastructure, satellite service providers, IT firms, MSPs, transportation, aviation and emergency services, with California, Texas and Hawaii the most targeted regions.
- The researchers said Silent Train's deployment was partly driven by the FBI's disruption of the KV-Botnet, which Volt Typhoon had used to evade detection in attacks on U.S. critical infrastructure.
Why it matters
The reported use of disposable relay chains and multiple zero-days against edge and management devices indicates that credential and infrastructure monitoring alone may not expose such intrusions.
What is unknown
The findings come from a single research organization and have not been independently confirmed here. The Quest KACE issue is described only as a suspected zero-day, and the source does not detail how the four reported zero-days were exploited or which specific victims were affected.
Timeline
- Version 1