Chinese Hackers Use Secret Silent Train Network to Exploit Zero-Day Vulnerabilities in U.S. Government and Defense Systems

Hackers linked to China’s Volt Typhoon have been using a covert routing network dubbed “Silent Train” to conceal zero-day attacks against U.S. government agencies, defense contractors and critical infrastructure providers.

Silent Train stitches together compromised routers, internet-connected devices and enterprise servers so operators can reach sensitive systems while hiding the true origin of their activity.

An investigation by Lumen’s Black Lotus Labs ties years of targeted intrusions to campaigns that abused centralized management platforms—systems that already have trusted access to many devices—letting attackers harvest credentials and move into customer environments without repeatedly compromising individual endpoints.

Researchers from Black Lotus Labs tracked Silent Train for roughly three years, issuing hundreds of victim notifications. In an October 28 report they describe four confirmed zero-day campaigns and one additional campaign likely involving an unknown vulnerability. Lumen characterizes Silent Train as an operational framework rather than a single malware family; analysts also discovered malicious in-memory webshells used during intrusions.

How Silent Train operations worked

First observed in November 2023, Silent Train emerged as Volt Typhoon shifted away from the disrupted KV-botnet infrastructure. Earlier reporting documented the group’s use of compromised networking gear as covert relays; Lumen’s analysis shows a more ephemeral, tightly controlled operating model.

Operators generally began sessions on virtual private servers outside the United States, routed through compromised overseas devices, then entered U.S.-based infrastructure before reaching targets. Using domestic exit points helped traffic look less suspicious and avoid simple geographic filtering. Some operations used as many as six intermediary hops between operator and target.

Lumen observed more than 27 device classes used as nodes in these chains, including TP-Link routers, Netgear Orbi devices, Fortinet appliances and CyberPanel servers. Operators exploited exposed web interfaces, installed temporary SSH services and keys, and pushed configuration files. Chains could be assembled in under two minutes; sessions averaged roughly four hours, after which operators removed tools and dismantled the connections.

Device roles in the chains were consistent: for example, Intelbras modems frequently served as overseas relays while Netgear Orbi devices commonly acted as U.S. hops. By early 2025, some enterprise systems were configured as longer-lived final connections that stayed active for one to three months. In certain cases operators relied on reverse tunnels instead of only sequential SSH hops.

Activity followed a human work schedule: most sessions took place Monday through Friday between about 09:00 and 22:00 China Standard Time, with fewer operations overnight and on weekends. Individual sessions usually targeted one to five victims—often only a single organization—highlighting the selective use of this covert infrastructure.

Why centralized management platforms mattered

Silent Train’s focus on centralized management platforms makes strategic sense. Endpoint managers and software-defined WAN controllers maintain inventories, store credentials and expose administration capabilities—compromise of one such system can provide broad access to downstream customers and managed devices.

Lumen linked Silent Train activity to exploitation of two previously undisclosed N-central vulnerabilities, and to separate campaigns targeting Versa Director, Cisco Catalyst SD‑WAN and VeloCloud Orchestrator. The Versa intrusions involved an in-memory JAR webshell that left little evidence on disk. Cisco activity abused trusted peering mechanisms, and VeloCloud became the third SD‑WAN platform exploited via Silent Train.

A distinct campaign against Quest KACE affected more than 30 victims, though limited logging prevented researchers from definitively identifying the exploited vulnerability. Lumen assessed the KACE zero-day linkage with moderate confidence, noting activity declined after October 2025 security updates.

Not every intrusion observed by Lumen proved use of a previously unknown vulnerability; the researchers could not determine the access vector for every targeted product. The findings extend earlier reporting on Cisco SD‑WAN zero-day exploitation by showing Volt Typhoon accessing the affected control plane by late 2025 and continuing activity after details were disclosed in February 2026.

Across multiple campaigns, attackers harvested credentials, misused remote administration and file-transfer features, and at times altered or erased logs to reduce traceability. Repeated geographic targeting included Hawaii, California and Texas. Identified victims spanned telecommunications firms, satellite communications providers, universities with defense connections and operators of essential services.

Lumen assesses the pattern is consistent with efforts to position access inside networks that support U.S. operations—particularly during potential Indo‑Pacific crises—rather than definitive evidence that disruption has already occurred.

Defensive recommendations include restricting internet-facing management interfaces, prioritizing vendor patches, and reviewing downstream trust relationships. Lumen also advises exporting logs off-platform, extending retention windows, and investigating unusual administrative actions, API requests, remote transfers and configuration changes—especially because attackers sometimes erase local evidence on compromised platforms.

Indicators of compromise (IoCs)

Note: IP addresses and domains in source reports have been intentionally defanged (for example, using “[.]”) to prevent accidental resolution or hyperlinking. Re‑fange only inside controlled threat‑intelligence platforms such as MISP, VirusTotal or a SIEM.

Give your SOC the alert context to stop incidents quickly. Integrate threat intelligence from thousands of SOCs.