Volt Typhoon: Silent Train Framework Exposed for Zero-Day Attacks

Black Lotus Labs documents Silent Train, the ephemeral infrastructure Volt Typhoon has used since late 2023 to exploit zero-days in network management platforms and hit hundreds of U.S. targets.

Black Lotus Labs, the threat intelligence division of Lumen, has published documentation on Silent Train, the operational framework Volt Typhoon has used since late 2023 to conduct cyber espionage campaigns against U.S. critical infrastructure. The disclosure, the result of three years of tracking and hundreds of victim notifications, reveals an ephemeral infrastructure model that reassembles attack chains in under two minutes.

Key Takeaways

Volt Typhoon exploited at least four confirmed zero-days in centralized management platforms: Versa Director, N-able N-central, Cisco Catalyst SD-WAN Controller, and Arista VeloCloud Orchestrator.
Silent Train assembles multi-hop chains from compromised SOHO, IoT, and enterprise devices, with strict geographic compartmentalization: Intelbras modems only for non-U.S. relays, Netgear Orbi and Fortinet FortiGate for U.S. exit points.
Attack sessions lasted an average of roughly four hours, some only minutes, with complete post-operation artifact removal via anti-forensic techniques.
The most targeted states — Hawaii, California, and Texas — host military installations, defense contractors, satellite communications providers, and logistics networks critical to the Indo-Pacific region.

Four Zero-Days in Network Control Platforms

The campaigns documented by Black Lotus Labs exploit previously undisclosed vulnerabilities in technologies that govern the control plane of enterprise networks. CVE-2024-39717 affects Versa Director. CVE-2025-8875 and CVE-2025-8876 affect N-able N-central. CVE-2026-20127 affects Cisco Catalyst SD-WAN Controller and is described in primary sources as an authentication bypass vulnerability. A fourth confirmed campaign exploits CVE-2026-16812 in Arista VeloCloud Orchestrator.

A fifth vulnerability, a likely zero-day in Quest KACE patched in October 2025, affected more than 30 specific victims. According to primary sources, the group compromised more than 27 device classes, from SOHO routers to enterprise platforms. The sources do not specify whether the list of exploited flaws is exhaustive.

How the Ephemeral Chain Works

Silent Train is not a conventional botnet. Per Black Lotus Labs' characterization, each attack chain is built on-demand: starting from staging VPS nodes, traversing non-U.S. relays, to U.S.-based exit points that mask the true origin. Lead researcher Michael Horka stated that Volt Typhoon has demonstrated "a repeatable ability to rebuild a new chain with different infrastructure in under two minutes, making the number of active nodes at any given time effectively near zero."

"Silent Train is built around rapidly rotating chains of compromised SOHO, IoT, and enterprise devices, exploited on demand, used against carefully selected targets, cleaned up after every operation, and continuously renewed" — Black Lotus Labs

Compartmentalization is rigorous. Intelbras modems appear exclusively as relays outside the United States. Netgear Orbi devices and Fortinet FortiGate appliances serve as intermediaries and exit points on U.S. soil. This geographic separation of roles prevents simple correlation of indicators of compromise based on IP.

Operators use ephemeral SSH services, keys, and volatile configuration files, "live off the land" tools already present on target systems, and remove every artifact at the end of the session. Subsequent platform maturation introduced reverse-tunnel variants through the open-source proxies Chisel and FRP.

Evolution Toward Hybrid and the Post-KV Botnet Spike

By early 2025, Silent Train had evolved its architecture: from a fully ephemeral relay network to a hybrid structure that retains enterprise-grade devices for one to three months while maintaining short-lived relays. This transition signals operational maturation and the need for more stable footholds for high-value strategic targets.

Activity intensified significantly after the takedown of the KV botnet in January 2024. Black Lotus Labs documents this surge as temporally correlated with the loss of the previous infrastructure. Primary sources do not establish a proven causal link beyond the coincidence of timelines.

Who Was Hit and Why Those Sectors

Black Lotus Labs notified hundreds of victims over three years of observation. Affected sectors include telecommunications, government agencies, defense contractors, satellite and mission-critical communications, universities, IT firms, water utilities, energy, transportation, maritime, rail, aviation, and emergency services.

The geographic distribution is not random. Hawaii, California, and Texas consistently ranked as the most targeted regions — a concentration primary sources link to the presence of military installations, telecommunications infrastructure, defense contractors, satellite communications providers, and logistics networks critical to Indo-Pacific operations. This targeting pattern reflects a strategic logic of pre-positioning in geopolitically sensitive nodes.

Researcher Michael Horka stated: "I don't think they're just pre-positioning or conducting espionage; I think it's a combination of both."

What to Do Now

Methodological note: The operational recommendations below derive exclusively from Black Lotus Labs, the sole structured primary source available for this incident. They have not been verified against multiple independent sources.

Organizations managing the affected platforms must verify patching for CVE-2024-39717, CVE-2025-8875, CVE-2025-8876, CVE-2026-20127, and CVE-2026-16812. Primary sources indicate Volt Typhoon specifically exploited exposed management interfaces and legitimate remote access tools to maintain persistence.

Black Lotus Labs recommends monitoring traffic to open-source proxies such as Chisel and FRP, tools cited in the framework's reverse-tunnel variants. Segmentation of administrative interfaces and reduction of the exposed attack surface of SOHO and IoT devices are indicated as relevant countermeasures given the documented operational context.

The ephemeral nature of nodes makes blocking based solely on static indicators of compromise impractical. Primary sources suggest focusing monitoring on behavioral patterns: rapid assembly of multi-hop chains, contained session durations, and systematic post-operation artifact removal.

Analysis: Beyond the Technique

The following section contains editorial analysis based on documented facts.

The problem posed by Silent Train lies not primarily in the sophistication of the zero-day exploits. The operational repeatability and the organizational structure supporting it are what primary sources characterize as exceptional. When a group rebuilds the entire attack chain in under two minutes, traditional defense loses a fundamental premise: the ability to react to an adversary that persists.

Volt Typhoon's model inverts conventional persistence logic. There is no need to maintain durable access if the entire infrastructure can be regenerated faster than a defender can analyze it. This capability, documented by Black Lotus Labs as a "repeatable operational model," shifts the problem from detection to structural prevention.

The choice to target centralized management platforms — SD-WAN, orchestrators, RMM platforms — indicates a preference for control of the management plane over mere data access. Primary sources do not specify the content of post-exploitation operations, but target selection suggests an interest in strategic positioning rather than immediate collection.

Sources

Sources and references

Get DeafLetter