Volt Typhoon Uses ‘Silent Train’ Relay Framework in Zero-Day Attacks
Summary
Black Lotus Labs reports that Volt Typhoon has used Silent Train for three years, chaining compromised devices as relays and exploiting at least four zero-days against edge and management systems.
Key points
- Black Lotus Labs says Silent Train routes attacks through VPS infrastructure and compromised devices, including Intelbras modems overseas and Netgear Orbi devices in the U.S.
- Researchers report observing exploits for CVE-2026-16812, CVE-2026-20127, CVE-2025-8875, CVE-2025-8876 and CVE-2024-39717; a zero-day affecting Quest KACE is suspected.
- Operators reportedly use exposed web interfaces on SOHO, IoT and relay devices to set up chained SSH access, then remove temporary services, keys and configuration files—often within eight hours.
- By early 2025, Silent Train reportedly included both disposable relays and compromised enterprise systems retained for one to three months.
- Researchers say the activity targets high-value organizations across sectors including government, telecommunications, utilities, defense and transportation.
- Black Lotus Labs recommends restricting internet access to administrative interfaces, promptly patching vulnerabilities, retaining centralized logs and monitoring unusual administrative activity.
Article Details
- Attack Vectors
- Exploitation of exposed web interfaces on SOHO, IoT, and other relay devices to create chained access paths.
- Zero-day exploitation targeting VeloCloudOrchestrator, Cisco Catalyst SD-WAN, N-able N-central, and Versa Director; Quest KACE exploitation was described as a suspected zero-day.
- Chained SSH access through compromised relay devices, including temporary SSH services, keys, and configuration files.
- Credential theft, data exfiltration, and persistent remote access to compromised systems.
- Defensive Notes
- Strengthen security around centralized management systems and restrict internet access to administrative interfaces.
- Rapidly patch vulnerabilities.
- Centralize logs and retain them for longer periods.
- Monitor for unusual administrative activity and review trusted connections that could expose customer or partner networks.
- Follow CISA and NCSC guidance on Volt Typhoon.
MITRE ATT&CK
T1021.004 · SSHOperators deployed tooling to enable chained SSH access through compromised relay nodes.T1070.004 · File DeletionAfter operations, typically within eight hours, operators removed tooling, keys, and configuration files from disposable relays.T1090.003 · Multi-hop ProxySilent Train routed activity through VPS infrastructure and chains of compromised devices acting as intermediate relays.T1190 · Exploit Public-Facing ApplicationVolt Typhoon operators exploited exposed web interfaces on relay devices and zero-day vulnerabilities in named edge and management products.
CVE
Threat Actors
Vendors
Products
Intelbras modemsBlack Lotus Labs says Intelbras modems served as overseas relays, while Netgear Orbi devices acted as hops in the U.S.N-able N-centralCVE-2025-8875 and CVE-2025-8876 – N-able N-centralNetgear Orbi devicesBlack Lotus Labs says Intelbras modems served as overseas relays, while Netgear Orbi devices acted as hops in the U.S.Quest KACEQuest KACE (suspected zero-day)
Countries
Industries
Aviationutilities/critical infrastructure, satellite service providers, IT firms, MSPs, transportation, aviation, and emergency services.DefenseTargets include telecommunication firms, government agencies, defense contractors, educational institutes, utilities/critical infrastructure, satellite service providers, IT firms, MSPs, transportation, aviation, andEmergency Servicesinfrastructure, satellite service providers, IT firms, MSPs, transportation, aviation, and emergency services.GovernmentTargets include telecommunication firms, government agencies, defense contractors, educational institutes, utilities/critical infrastructure, satellite service providers, IT firms, MSPs, transportation, aviation, andTransportationinstitutes, utilities/critical infrastructure, satellite service providers, IT firms, MSPs, transportation, aviation, and emergency services.