Volt Typhoon's 'Silent Train' Network Hid Four Zero-Day Campaigns Behind Hijacked Everyday Devices

Researchers at Lumen Technologies' Black Lotus Labs have linked the China-nexus espionage group Volt Typhoon to a covert access network called Silent Train. First identified in late 2023 and now disrupted, it relied on rotating chains of compromised small office and home office (SOHO) devices, Internet of Things (IoT) devices and enterprise infrastructure. Lumen says it used anti-forensic techniques, compartmentalised operations and cleanup after each operation to avoid detection and attribution.

The network was used for exploiting vulnerabilities, accessing credentials, stealing data and keeping long-term access to victims. Black Lotus Labs confirmed four zero-day campaigns run through it, including the earlier exploitation of a Versa Director flaw (CVE-2024-39717) to deploy a web shell that harvested credentials. Volt Typhoon is also suspected of exploiting a likely zero-day in Quest KACE before it was patched in October 2025, affecting an estimated 30 or more victims.

Hundreds of victims have been identified, including telecommunications providers, government, defence contractors, satellite and mission-critical communications, universities, IT firms, and critical infrastructure such as water, energy, transport, maritime, rail, aviation and emergency services. Black Lotus Labs describes the network as devices that are exploited on demand, used against carefully selected targets, cleaned up and continuously refreshed. This is only the opening of the source report, so further detail may be available from the original coverage.