Chinese Hackers Use Secret Silent Train Network to Exploit Zero-Days Against U.S. Government and Defense

China-linked Volt Typhoon hackers have used a covert network called Silent Train to hide zero-day attacks against U.S. government agencies, defense contractors and critical infrastructure.

The network chains together compromised routers, connected devices and enterprise servers, helping operators reach sensitive systems while concealing where their activity begins.

The investigation connects years of carefully targeted intrusions to attacks on centralized management platforms.

These systems already hold trusted access to large networks, allowing attackers to steal credentials and reach customer environments without repeatedly breaking into individual machines.

Researchers from Lumen’s Black Lotus Labs identified and tracked Silent Train over three years, issuing hundreds of victim notifications.

Their October 28 report describes four confirmed zero-day campaigns and one likely campaign. Silent Train is an operational framework, not a single malware family; investigations also uncovered malicious in-memory webshells.

Chinese Hackers Use Secret Silent Train Network

First observed in November 2023, Silent Train grew as Volt Typhoon moved beyond its disrupted KV-botnet infrastructure.

Earlier reporting on Volt Typhoon router exploitation documented the group’s use of compromised networking equipment as covert relays, but Lumen describes a more disposable and tightly controlled operating model.

Sessions start on virtual private servers outside the United States, pass through compromised overseas devices, then enter U.S.-based infrastructure before reaching victims.

Domestic exit points help traffic appear less suspicious and evade geographic restrictions. Some operations placed as many as six intermediary hops between the operator and target.

Lumen observed more than 27 device classes, including TP-Link routers, Netgear Orbi devices, Fortinet appliances and CyberPanel servers.

Operators exploited exposed web interfaces and installed temporary SSH services, keys and configuration files. Chains could be assembled in under two minutes, while sessions averaged about four hours. Operators then removed their tools and dismantled the connections.

Device roles remained consistent: Intelbras modems appeared as overseas relays, while Netgear Orbi devices served as U.S. hops.

By early 2025, enterprise systems added longer-lived final connections that remained active for one to three months. Some sessions also used reverse tunnels instead of relying entirely on sequential SSH connections.

Activity also followed a human work pattern. Most sessions occurred Monday through Friday, between 09:00 and 22:00 China Standard Time, with less activity overnight and on weekends.

Individual sessions generally targeted one to five victims, often just one organization, underscoring the group’s selective use of the covert network.

Management Platforms Give Attackers Wider Access

The targets explain the value of this hidden infrastructure. Endpoint managers and software-defined wide-area network controllers provide device inventories, credentials and administrative functions.

Previous coverage of exposed N-central management servers highlighted how weaknesses in one platform can threaten managed service providers and customers. Lumen linked Silent Train activity to exploitation of two previously undisclosed N-central vulnerabilities.

Other campaigns targeted Versa Director, Cisco Catalyst SD-WAN and VeloCloud Orchestrator. Versa intrusions involved an in-memory JAR webshell that reduced evidence on disk.

Cisco activity targeted trusted peering mechanisms, while VeloCloud became the third SD-WAN platform exploited through Silent Train.

A separate Quest KACE campaign affected more than 30 victims, although limited logs prevented researchers from identifying the underlying flaw.

Lumen assessed the KACE zero-day link with moderate confidence, noting that activity declined after October 2025 security updates.

That distinction matters: not every observed intrusion proves an unknown vulnerability was used, and the researchers could not determine the access method for every targeted product.

The findings also extend earlier reporting on Cisco SD-WAN zero-day exploitation by showing Volt Typhoon using the affected control plane by late 2025 and continuing after disclosure in February 2026.

Across campaigns, attackers harvested credentials, abused remote administration and file-transfer features, and sometimes altered or erased logs.

Hawaii, California and Texas repeatedly emerged as targeting hotspots. Victims included telecommunications companies, satellite communications providers, universities with defense ties and essential service operators.

Lumen considers the pattern consistent with positioning access inside networks supporting U.S. operations, particularly during Indo-Pacific crises, rather than evidence that disruption has already occurred.

Defenders should restrict internet-facing management interfaces, prioritize vendor patches and review downstream trust relationships.

Lumen also recommends exporting logs, extending retention and investigating unusual administrative activity, API requests, remote transfers and configuration changes. External logging is particularly important when attackers can erase evidence on the compromised platform.

Indicators of compromise (IoCs):-

Category	Source-reported reference
N-central vulnerabilities	CVE-2025-8875; CVE-2025-8876
Cisco vulnerability	CVE-2026-20127
VeloCloud vulnerability	CVE-2026-16812
Reverse-tunnel tools	Chisel; FRP
Observed behavior	Temporary SSH artifacts; altered logs; in-memory webshells

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.