China-linked cyber espionage group Volt Typhoon has used a covert network of compromised routers, internet-connected devices and enterprise systems to conceal intrusions into organizations operating critical infrastructure, according to new research from Lumen Technologies’ Black Lotus Labs.
The researchers call the framework “Silent Train” and say they have tracked it since late 2023. Rather than relying on a fixed set of command-and-control servers, the operators assemble temporary chains of compromised devices, route their activity through multiple countries and dismantle the links after an operation. The approach makes it harder for defenders to trace the traffic back to its source.
According to Lumen’s investigation, an operation can begin with a virtual private server outside the United States, pass through compromised small-office routers and IoT devices in other countries, and then use a compromised device inside the United States before reaching a target. Black Lotus Labs observed more than 27 device classes in the network, including equipment from TP-Link, Netgear, Zyxel and Fortinet.
Lumen said Silent Train was used in four confirmed zero-day campaigns targeting enterprise management and network control systems, along with one additional campaign that it considers likely to have involved a previously unknown flaw. The confirmed activity involved Versa Director (CVE-2024-39717), N-able N-central (CVE-2025-8875 and CVE-2025-8876), Cisco Catalyst SD-WAN (CVE-2026-20127) and Arista VeloCloud Orchestrator (CVE-2026-16812). The suspected campaign involved Quest KACE, where investigators said limited log data prevented them from confirming the underlying vulnerability.
One of the documented campaigns targeted Cisco Catalyst SD-WAN through CVE-2026-20127, the same vulnerability involved in a separate report about KeyDrift malware targeting Cisco SD-WAN systems. Lumen said attackers focused on centralized management platforms because a successful compromise can provide broad administrative visibility and access to connected systems, sometimes without the need to move laterally through the victim’s network.
The relay chains were designed to be short-lived. Black Lotus Labs said operators could assemble a chain in under two minutes, while sessions averaged around four hours and sometimes lasted only minutes. After completing an operation, they removed temporary tools, SSH keys, configuration files and other traces from the compromised devices. Some enterprise platforms were kept in the network for longer periods and reused across multiple intrusions.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Over three years of monitoring, Black Lotus Labs said it notified hundreds of organizations in sectors including telecommunications, government, defense, satellite communications, managed services, universities and critical infrastructure. The researchers identified recurring targeting activity in California, Texas and Hawaii, but did not publicly name the affected organizations. The findings were also reported by BleepingComputer and The Hacker News.
