Volt Typhoon’s Silent Train: How disposable relays hide zero-day attacks
Black Lotus Labs says Chinese state-sponsored group Volt Typhoon is using Silent Train, a relay framework that chains compromised devices into temporary attack paths for zero-day operations. The approach matters because the group can hide the origin of attacks, remove its tooling after an operation and reach high-value systems through exposed management infrastructure rather than relying only on conspicuous lateral movement.
Silent Train is built as a disposable relay network. The operators route activity through virtual private servers outside the United States and then through hacked devices, including routers, before launching attacks. Black Lotus Labs observed Intelbras modems used as overseas relays and Netgear Orbi devices as U.S. hops. The framework can support vulnerability exploitation, credential theft, data exfiltration and persistent remote access.
The researchers observed zero-day exploitation against VeloCloudOrchestrator, Cisco Catalyst SD-WAN, N-able N-central and Versa Director. They also list Quest KACE as a suspected zero-day target. These are management and infrastructure platforms, so compromise can provide administrative control, enable credential theft and create access to downstream customers without the noisy movement that can trigger detection.
The named vulnerabilities are CVE-2026-16812 in VeloCloudOrchestrator, CVE-2026-20127 in Cisco Catalyst SD-WAN, CVE-2025-8875 and CVE-2025-8876 in N-able N-central, and CVE-2024-39717 in Versa Director. The evidence does not provide fixed-version information for these products, so administrators should not assume that a generic update resolves every listed issue; they need to follow the relevant vendor and security-advisory guidance.
The operating model also changed over time. According to the researchers, sessions typically lasted under eight hours and the attackers removed temporary SSH services, keys and configuration files afterward. By early 2025, Silent Train had become hybrid: disposable relays were combined with compromised enterprise systems retained for one to three months. That makes short-lived indicators useful, but insufficient on their own for investigating possible compromise.
The reported targets span telecommunications, government, defense, education, utilities and other critical infrastructure, as well as IT firms, managed service providers, transportation, aviation and emergency services. Black Lotus Labs says California, Texas and Hawaii were the most targeted regions in its observations. The group has previously targeted U.S. communications, energy, transportation and water systems, and CISA warned that it seeks access that could support disruption during a future crisis or conflict.
For affected organizations, the researchers recommend protecting centralized management systems, restricting internet access to administrative interfaces, applying vulnerability patches rapidly and centralizing logs with longer retention. They also advise reviewing unusual administrative activity and trusted connections that could expose customer or partner networks, while following CISA and NCSC guidance on Volt Typhoon. Because Silent Train can disappear after an operation, retaining the evidence needed for retrospective investigation is particularly important.