Recent research published by Black Lotus Labs, the security research arm of Lumen, has revealed that the Chinese hacking group known as Volt Typhoon is using an advanced technical framework called Silent Train. This framework aims to conceal the origins of cyber attacks targeting high-value systems, including the exploitation of zero-day vulnerabilities in management and network infrastructure.
How Silent Train Works
The Silent Train framework relies on a relay network consisting of compromised connected devices that are constantly rotated. The attackers direct their activity through virtual private servers (VPS) outside the United States, then pass it through intermediary devices such as routers before launching the final attack. Notably, attackers clean up their tools, access keys, and configuration files after each operation, which typically lasts less than 8 hours, making them extremely difficult to track.
Why This News Matters
This development represents a shift in Volt Typhoon's tactics following the disruption of their previous botnet (KV-Botnet) by the FBI. Attackers are now focusing on exploiting vulnerabilities in sensitive management platforms, granting them broad administrative control without the need for noisy lateral movements within the network that could lead to their detection. Targets include critical sectors such as telecommunications, energy, transportation, and government institutions, with a notable geographic focus on areas in the United States relevant to regional affairs in the Indo-Pacific.
Targeted Vulnerabilities
Researchers were able to observe the exploitation of zero-day vulnerabilities in several technology products, including:
- VeloCloud Orchestrator (CVE-2026-16812)
- Cisco Catalyst SD-WAN (CVE-2026-20127)
- N-able N-central (CVE-2025-8875 and CVE-2025-8876)
- Versa Director (CVE-2024-39717)
Security Recommendations
Experts advise enhancing the security of central management systems, restricting internet access to management interfaces, and rapidly patching security vulnerabilities. It is also emphasized to centralize logs while retaining them for longer periods, monitor any unusual administrative activity, and review trusted connections that may compromise partner or customer networks.