Vulnerabilities · Threat Intelligence
Volt Typhoon used 'Silent Train' to hide zero-day attacks on critical systems
Researchers say Volt Typhoon used a covert network of hacked devices, called 'Silent Train', to exploit four zero-day flaws in key infrastructure. Hundreds of organisations may have been affected.
Ross Grant3 min read
The short version
A group called Volt Typhoon used a secret network of hacked devices to attack important organisations in the US and beyond. They took advantage of software flaws that nobody knew about at the time, making the attacks hard to spot. The attackers used each hacked device only briefly and cleaned up after themselves, which made it even harder to detect. Many types of companies and agencies were targeted, including those running water, energy, and transport systems.
By the numbers
- 4zero-day vulnerabilities exploitedThe Hacker News
- hundredsorganisations targetedThe Hacker News
- 27device types abused as relaysThe Hacker News
What happened?
Researchers say the Chinese state-sponsored group Volt Typhoon used a covert network of hacked devices, called 'Silent Train', to launch zero-day attacks on critical infrastructure and enterprise networks. At least four previously unknown vulnerabilities were exploited. Hundreds of organisations may have been affected, but the full scale is not yet confirmed.
Who is affected
Researchers at Black Lotus Labs say the Chinese state-sponsored group Volt Typhoon targeted hundreds of organisations using the 'Silent Train' framework. Victims include telecoms providers, government agencies, defence contractors, universities, IT firms, managed service providers, and operators of critical infrastructure such as water, energy, transportation, maritime, rail, aviation, and emergency services. The most targeted regions were California, Texas, and Hawaii, suggesting a focus on Indo-Pacific interests. BleepingComputer (opens in a new tab) The Hacker News (opens in a new tab)
How the attack worked
Volt Typhoon used a covert network called 'Silent Train', made up of chains of compromised devices, to hide the origins of their attacks. The attackers would compromise small office/home office (SOHO) routers, Internet of Things (IoT) devices, and enterprise equipment, then link them together as relays. Each attack session used a new set of devices, which were cleaned up and dismantled afterwards. This made it hard for defenders to trace or block the attacks. Sessions lasted about four hours on average, sometimes only minutes. The attackers used virtual private servers (VPS) outside the US as starting points, then routed traffic through non-US and US-based devices before reaching the final target. Devices from at least 27 manufacturers were abused, including Intelbras modems (as overseas relays) and Netgear Orbi and Fortinet FortiGate appliances (as US exit points). The attackers exploited exposed web interfaces, deployed temporary SSH (secure shell) services, and removed all traces after use.
How the flaw works
Black Lotus Labs observed Volt Typhoon exploiting at least four zero-day vulnerabilities (flaws unknown to the vendor at the time of attack) in edge and management infrastructure. The confirmed exploited products and vulnerabilities are:
- Versa Director: file upload flaw (CVE-2024-39717) used to install a web shell for credential theft and downstream access.
- N-able N-central: insecure deserialization and command injection (CVE-2025-8875, CVE-2025-8876).
- Cisco Catalyst SD-WAN Controller: authentication bypass (CVE-2026-20127).
- Arista VeloCloud Orchestrator: command injection (CVE-2026-16812).
There is also suspicion of a zero-day in Quest KACE, patched in October 2025, affecting over 30 victims. The attacks focused on management platforms and control plane technologies, which can provide wide access across enterprise networks.
The response
The 'Silent Train' network was identified and disrupted by researchers, but the reporting does not say if vendors or authorities have released patches or further guidance. The shift to Silent Train was partly in response to the FBI's takedown of the KV-Botnet, which Volt Typhoon had previously used for similar purposes. The group continues to adapt its methods to avoid detection and disruption.
What you should do
Organisations running the affected products should check for vendor advisories and apply patches as soon as available. Monitoring for unusual SSH activity and reviewing logs for short-lived connections from unexpected device types may help detect similar attacks. Network segmentation and limiting remote management exposure can reduce risk. Since attackers removed traces, retrospective detection may be difficult.
Why it matters
This attack shows how advanced groups can use unknown software flaws and a constantly changing network of hacked devices to target critical infrastructure. It highlights the need for rapid patching, monitoring, and layered defences, especially for organisations running management and control systems.
Key points
- Volt Typhoon used a covert network ('Silent Train') to hide zero-day attacks.
- At least four unknown vulnerabilities in key management products were exploited.
- Hundreds of critical infrastructure and enterprise organisations were targeted.
- Attackers used compromised devices as short-lived relays and cleaned up after each session.
- Detection is difficult due to rapid rotation and anti-forensic tactics.
Sources
BleepingComputer
Reference
The Hacker News
Reference
