Silent Train: uncovering Volt Typhoon's operational framework for zero-day exploitation and strategic access - Lumen Technologies

For the past three years, Black Lotus Labs has monitored a covert operational framework used by the Chinese state-sponsored group Volt Typhoon, dubbed “Silent Train.” This system is designed to gain and maintain access to the technologies businesses rely on to manage devices, networks and critical operations, allowing the group to exploit previously unknown vulnerabilities in centralized management platforms.

The group has used rapidly changing chains of compromised infrastructure to conceal its activity, employing anti-forensic techniques, compartmentalized operations and post-operation cleanup to minimize detection and attribution. This disciplined approach has allowed them to carry out exploitation and post-exploitation activity securely while reducing the risk of detection, attribution and disruption.

Rotating chains of compromised devices

Unlike traditional botnets or proxy networks, Silent Train is built around rapidly rotating chains of compromised SOHO, IoT and enterprise devices that are exploited on demand, used against carefully selected targets, cleaned up after each operation and continuously refreshed. This approach allowed Volt Typhoon to carry out its objectives securely while protecting valuable access capabilities.

The group has exploited at least four confirmed and one likely zero-day vulnerabilities, targeting network and endpoint management systems, SD-WAN orchestrators and control plane infrastructure that provide visibility, administration and access across enterprise and customer environments. Victims included telecommunications providers, government agencies, defense contractors, satellite and mission-critical communication services, universities, IT firms and critical infrastructure such as water, energy, transportation, maritime, rail, aviation and emergency services.

Victimology indicates deliberate efforts to maintain access to critical ecosystems that support defense, logistics, communications, military and civilian operations, especially during heightened tensions or crises in the Indo-Pacific region. Hawaii, California and Texas consistently emerged as the most targeted regions, reflecting a sustained focus on communications, logistics, defense and critical infrastructure ecosystems that support strategically significant U.S. operations.

A layered, multi-hop framework

The Silent Train architecture is a layered, multi-hop framework that lets Volt Typhoon operators route activity through multiple devices before reaching targets. Sessions began from virtual private servers (VPS) outside the U.S., then daisy-chained through compromised non-U.S. devices before pivoting within the U.S. to reach targets.

Each link in the chain served a distinct operational purpose. The initial VPS served as a temporary staging area that could be quickly provisioned and discarded after each session. The secondary VPS further separated the operator while adding geographic and provider diversity. Compromised non-U.S. SOHO and IoT devices routed activity through different countries, providers and hardware to obscure its true origin. Compromised U.S.-based devices provided a domestic exit point before the victim, helping malicious traffic blend in and bypass geo-blocking and IP reputation filters.

Together, these layers compartmentalized operations, hindered attribution and made the full chain difficult to trace. Black Lotus Labs uncovered a repeatable operational model for acquiring, protecting and sustaining strategic access at scale, with more than 27 device classes exploited and used in Silent Train operations, ranging from SOHO and IoT devices like TP-Link routers and Netgear Orbi devices to enterprise platforms like Fortinet appliances and CyberPanel servers.

Short-lived, self-managed sessions

Silent Train stands out for its operational discipline, focusing on short-lived, self-managed sessions rather than persistent relays or C2 infrastructure. To construct these sessions, its operators exploit exposed web interfaces on SOHO, IoT and other relay devices, then deploy only the tooling needed to enable chained SSH access through the compromised node.

This included temporary SSH services, keys, configuration files and “live off the land” utilities. At the end of each session, operators removed all artifacts and dismantled the chain. Sessions averaged about four hours, though some lasted only minutes. Some relay device types lack known vulnerabilities, suggesting Volt Typhoon leveraged undisclosed zero-day exploits to set up a single relay in a four-to-six hop chain and indicating a willingness to commit significant resources to protecting future access capabilities.

The disruption of KV-botnet in late 2023 dealt a major blow to Volt Typhoon’s infrastructure. After discovering and tracking the botnet, Black Lotus Labs worked with U.S. agencies to investigate its activity, notify victims and disrupt thousands of compromised routers used to conceal exploitation. Although the operation successfully disrupted a key covert-access capability, Volt Typhoon had already begun developing a far more elusive obfuscation framework.

We first observed consistent Silent Train activity in November 2023, shortly before the initial KV-botnet takedown. Activity increased after the second disruption, with rapid changes in device types, geographic reach and short-lived operational patterns. Instead of relying on persistent infrastructure, Volt Typhoon adopted disposable chains of compromised devices that could be rebuilt as needed.