Volt Typhoon runs attacks through a covert 'Silent Train' network it rebuilds in minutes

The China-government-backed hacking group Volt Typhoon runs its intrusions through a covert, constantly rotating network of hacked devices that it can rebuild in under two minutes, researchers at Lumen Technologies' Black Lotus Labs said in a report dated October 28, 2026 and covered by CyberScoop. The findings show how one of the most closely watched state actors stays hidden while targeting critical infrastructure.

What happened

Black Lotus Labs calls the operation "Silent Train." According to CyberScoop, it is not a standalone network but a series of rapidly rotated compromised devices — small office/home office (SOHO) routers, internet-of-things (IoT) gear and enterprise infrastructure — chained together to relay the group's traffic. Volt Typhoon has used these chains to reach and exploit further targets, including zero-day vulnerabilities in network edge devices, to gain persistent access.

Technical details

Principal information security engineer Michael Horka said "individual chains are assembled and dismantled every day," and that Volt Typhoon "demonstrated a repeatable capability to rebuild a new chain with different infrastructure in less than two minutes." Sessions averaged roughly four hours. CyberScoop reports the rotation has run since late 2023 and that the group leaned more heavily on Silent Train after the FBI and Justice Department disrupted its KV Botnet in early 2024. The report names zero-day campaigns against Versa Director, N-Able N-Central, Cisco Catalyst SD-WAN and VeloCloud Orchestrator, and says more than 27 device classes have been exploited — spanning edge devices, enterprise management tools, identity systems and networking gear from Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto Networks, ServiceNow, TP-Link, Netgear and ArcGIS.

Who is affected

Black Lotus Labs has notified hundreds of victims, including telecom providers, government entities, defense contractors, communication services, universities and IT firms, CyberScoop reports. Critical-infrastructure victims span the water, energy, transportation, maritime, rail, aviation and emergency-services sectors. The report attributes the activity to the Chinese government. Horka cautioned that "the ephemeral nature of the framework means our observations should not be interpreted as a complete census of Volt Typhoon activity," underscoring that defenders likely see only part of the picture.

What to do

The findings reinforce long-standing guidance for operators of edge and network devices: apply vendor security updates promptly, since the group leans on edge-device zero-days and unpatched gear; replace end-of-life routers and IoT equipment that no longer receive fixes; and watch for short-lived, unusual outbound connections through SOHO and edge devices that could indicate relay activity. Organizations in the targeted critical-infrastructure sectors should treat edge-device compromise as a realistic threat and review access to management interfaces.