For years, the standard picture of a state-backed intrusion crew's infrastructure has been a botnet: a big, relatively stable herd of hijacked routers that defenders can eventually map, sinkhole or take down. New research from Lumen's Black Lotus Labs describes something harder to pin down. According to the company's report, the group tracked as Volt Typhoon has spent roughly three years running what researchers call "Silent Train," a framework of short-lived relay chains built from compromised devices. The chains are stood up for an operation, used, cleaned up and thrown away.

Black Lotus Labs says it first spotted the framework in late 2023 and has tracked it since. In that time, the researchers tied it to at least four confirmed zero-day campaigns and one likely one, all aimed at the software organizations use to manage their networks and endpoints. The company says it sent hundreds of victim notifications.

What is Silent Train, exactly?

A relay network is a chain of machines that traffic passes through before it reaches its target. Each hop hides where the traffic really came from, so the victim sees a connection from some ordinary-looking router or server and not from the operator. Lumen describes Silent Train as rotating chains of compromised small-office/home-office (SOHO) routers, Internet-of-Things devices and enterprise infrastructure, combined with anti-forensics and deliberate cleanup after each operation.

What stands out is how fast it moves. Black Lotus Labs researcher Michael Horka told CyberScoop that chains can be rebuilt in under two minutes, and that sessions run about four hours on average. Researchers counted more than 27 classes of devices pressed into service, with hardware and software from vendors including Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto Networks, ServiceNow, TP-Link, Netgear and ArcGIS.

For defenders, the practical effect is that blocklists go stale almost immediately. By the time a suspicious IP address shows up in a log review, the chain that used it may already be gone, and the same device may be a normal customer's router again the next day.

Why did the infrastructure change?

According to CyberScoop's reporting, Volt Typhoon leaned more heavily on this approach after the FBI and Justice Department disrupted the KV Botnet, an earlier network of hijacked routers associated with the group. A large, persistent botnet is a single target that law enforcement can take down. A constantly rebuilt chain of devices borrowed for a few hours is a much harder thing to dismantle with one operation.

Which zero-days were involved?

The common thread in the campaigns is the management plane: the consoles and orchestrators administrators use to configure and control many devices at once. Compromise one of those and an attacker can reach far more than a single machine. Lumen's report says the targets included network and endpoint management tools, SD-WAN orchestrators and other control-plane systems. (SD-WAN, or software-defined wide area networking, lets an organization run its branch-office links from a central controller.)

Help Net Security lists the vulnerabilities tied to the campaigns:

  • Versa Director: CVE-2024-39717
  • N-able N-central: CVE-2025-8875 and CVE-2025-8876
  • Cisco Catalyst SD-WAN: CVE-2026-20127
  • VeloCloud Orchestrator: CVE-2026-16812
  • Quest KACE: possibly an unknown zero-day; this is the "likely" case, not a confirmed one

The confirmed cases are described by Lumen and press coverage as zero-days, meaning the flaws were exploited before vendor fixes were available; the Quest KACE case involves a possible, unidentified zero-day. Help Net Security reports that post-incident analysis turned up in-memory webshells, credential harvesting and log tampering. An in-memory webshell is a backdoor that runs inside a server process without writing a file to disk, so file-based scans and reboots can miss or erase the evidence. Combine that with log tampering and the relay chain's cleanup, and investigators can be left with very little to work with.

Who got hit?

Lumen says its notifications went to organizations in telecommunications, government, defense contracting, satellite and other sectors. CyberScoop adds water, energy, transportation, maritime, rail, aviation and emergency services. That mix of critical-infrastructure operators and the contractors serving them is consistent with the long-term strategic access Lumen's report describes, rather than quick data theft. The individual victims have not been named.

Where does Cisco Talos fit in?

Help Net Security reports that Cisco Talos separately says a cluster it tracks as UAT-11473 exploited the Cisco Catalyst SD-WAN flaw, CVE-2026-20127, and deployed malware called KeyDrift, using infrastructure that overlaps with Silent Train. We could not access Talos' own publication, so this account comes from Help Net Security's coverage. "Overlapping infrastructure" is also a narrower claim than saying the two clusters are the same operator, and readers should treat it that way.

What It Means for Defenders

Lumen's guidance comes down to four things: reduce exposure, patch faster, tighten access controls and keep your telemetry. Here is what that means in practice, based on the sources.

Find your management planes and get them off the open internet. If you run Versa Director, N-able N-central, Cisco Catalyst SD-WAN management components, VeloCloud Orchestrator or Quest KACE, check whether their admin interfaces can be reached from the public internet. Where possible, restrict them to management networks, VPN or allow-listed source addresses. These consoles were the targets because one foothold there opens up everything they manage.

Patch the listed CVEs. Confirm that fixes are applied for CVE-2024-39717, CVE-2025-8875, CVE-2025-8876, CVE-2026-20127 and CVE-2026-16812. The sources used here do not give specific fixed version numbers, so check each vendor's advisory for the correct release for your deployment. Because these flaws were reportedly exploited as zero-days, patching now does not undo a compromise that happened earlier. Treat exposed systems as possibly compromised and investigate them.

Assume credentials on those systems may be compromised. Investigators found credential harvesting, so rotate administrative and service-account credentials on affected management platforms and on the devices they control. Enforce strong authentication and least-privilege access on admin consoles.

Keep logs somewhere the attacker can't edit them. Log tampering was part of the playbook. Ship management-platform and network-device logs off the box to a central store as they are generated, and keep them long enough to investigate past activity. Lumen specifically calls out preserving telemetry.

Don't rely only on IP indicators. When relay chains are rebuilt in under two minutes, IP blocklists have limited value. Look for behavior: unusual admin logins on management consoles, unexpected configuration changes, unfamiliar processes inside management-server application stacks (in-memory webshells won't show up as new files) and gaps or edits in logs.

Look after your own edge devices. The relay chains were built from ordinary SOHO routers, IoT gear and enterprise appliances across more than 27 device classes. End-of-life routers and unpatched edge appliances are the raw material for this kind of network. Retire unsupported hardware and keep firmware current, both to protect your network and to keep your equipment out of someone else's attack.

For defense contractors working through CMMC: defense contractors are named among the targeted sectors. The steps above (limiting exposure of admin interfaces, managing privileged credentials, protecting audit logs) line up with controls you are probably documenting already. This research is a good reason to confirm they are actually enforced on your management tooling, not just written into your system security plan.

Sources