Black Lotus Labs Links Volt Typhoon to Silent Train Network Used in Zero-Day Campaigns
Summary
Lumen’s Black Lotus Labs links Volt Typhoon to Silent Train, a covert network of compromised devices used for four reported zero-day campaigns. The report describes its rotating relay chains, operational methods and evolution.
Key points
- Black Lotus Labs attributes Silent Train to Volt Typhoon and says the network was first identified in late 2023.
- The report describes rotating, multi-hop chains of compromised SOHO, IoT and enterprise devices used to relay traffic and obscure its origin.
- Black Lotus Labs says the network supported four confirmed zero-day campaigns, including exploitation of Versa Director CVE-2024-39717 to deploy the VersaMem web shell.
- A separate campaign involving a likely Quest KACE zero-day is suspected; the article estimates it affected more than 30 victims.
- The operators reportedly exploited exposed web interfaces, enabled chained SSH access, and removed tools and artifacts after sessions that averaged about four hours.
- The report identifies at least 27 device classes used in the network and says its architecture shifted toward retaining some enterprise devices for one to three months by early 2025.
- Black Lotus Labs identified hundreds of victims across critical infrastructure and other sectors; the article does not establish that every identified victim suffered the same impact.
Article Details
- Attack Vectors
- Exploitation of exposed web interfaces on compromised SOHO, IoT, and enterprise devices, including zero-day campaigns.
- Exploitation of a file upload vulnerability in Versa Director (CVE-2024-39717) to deliver the VersaMem web shell.
- Chained SSH access through compromised relay devices, with traffic routed through multiple nodes to obscure its origin.
- Reverse tunnels using Chisel and FRP to send traffic from infected devices to upstream infrastructure.
- Defensive Notes
- Silent Train used short-lived sessions averaging about four hours, sometimes only minutes, and operators removed operational artifacts and dismantled chains after sessions.
- By early 2025, the network reportedly retained some enterprise-grade devices for one to three months rather than replacing them after each engagement.
- The article describes exposed web interfaces on SOHO, IoT, and enterprise devices as entry points for compromising and enrolling relay nodes.
MITRE ATT&CK
T1021.004 · SSHOperators deployed temporary tooling to enable chained SSH access through compromised relay devices.T1070.004 · File DeletionAfter operational sessions, operators reportedly removed temporary SSH services, keys, configuration files, and other artifacts.T1090.003 · Multi-hop ProxySilent Train relayed traffic through multiple compromised devices to obscure its origin from victims and defenders.T1190 · Exploit Public-Facing ApplicationVolt Typhoon exploited exposed web interfaces and zero-day vulnerabilities, including the Versa Director file upload vulnerability CVE-2024-39717.T1572 · Protocol TunnelingLater Silent Train variants used reverse tunnels with Chisel and FRP to send traffic from infected devices to upstream infrastructure.
CVE
Threat Actors
Bronze SilhouetteThe article identifies Bronze Silhouette as an alias of Volt Typhoon, which it attributes with operating Silent Train and conducting zero-day exploitation campaigns.Insidious TaurusThe article identifies Insidious Taurus as an alias of Volt Typhoon, which it attributes with operating Silent Train and conducting zero-day exploitation campaigns.UNC3236The article identifies UNC3236 as an alias of Volt Typhoon, which it attributes with operating Silent Train and conducting zero-day exploitation campaigns.Vanguard PandaThe article identifies Vanguard Panda as an alias of Volt Typhoon, which it attributes with operating Silent Train and conducting zero-day exploitation campaigns.Volt TyphoonThe article attributes the Silent Train covert access network and its zero-day exploitation campaigns to Volt Typhoon.
Malware
Vendors
FortinetTP-Link, Intelbras, Ruckus Wireless, SATO, NETGEAR, Zyxel, and Cambium) to enterprise platforms (e.g., Fortinet, Cisco, PRTG, Mirth Connect, and CyberPanel), have been exploited and enrolled into the covert network.IntelbrasNo less than 27 device classes, ranging from SOHO and IoT devices (e.g., TP-Link, Intelbras, Ruckus Wireless, SATO, NETGEAR, Zyxel, and Cambium) to enterprise platforms (e.g., Fortinet, Cisco, PRTG, Mirth Connect, andNETGEAR27 device classes, ranging from SOHO and IoT devices (e.g., TP-Link, Intelbras, Ruckus Wireless, SATO, NETGEAR, Zyxel, and Cambium) to enterprise platforms (e.g., Fortinet, Cisco, PRTG, Mirth Connect, andQuestSeparately, Volt Typhoon is also suspected to have taken advantage of a likely zero-day vulnerability in Quest KACE before it was patched in October 2025. The campaign is estimated to have impacted more than 30 victims.Versasince at least 2021, the threat actor was previously observed exploiting a file upload vulnerability in Versa Director as a zero-day (CVE-2024-39717) to deliver a bespoke web shell called VersaMem designed to harvest
Products
Fortinet FortiGateIntelbras modems have been found to only appear as relay nodes, while Netgear Orbi and Fortinet FortiGate appliances served as U.S.-based intermediary and exit points responsible for interacting with the victim.Netgear OrbiSilent Train. For instance, Intelbras modems have been found to only appear as relay nodes, while Netgear Orbi and Fortinet FortiGate appliances served as U.S.-based intermediary and exit points responsible forQuest KACESeparately, Volt Typhoon is also suspected to have taken advantage of a likely zero-day vulnerability in Quest KACE before it was patched in October 2025. The campaign is estimated to have impacted more than 30 victims.Versa Directorat least 2021, the threat actor was previously observed exploiting a file upload vulnerability in Versa Director as a zero-day (CVE-2024-39717) to deliver a bespoke web shell called VersaMem designed to harvest
Tools
ChiselSubsequent maturation of the platform introduced reverse-tunnel variants that used open-source proxies like Chisel and FRP to send traffic from infected devices to upstream infrastructure.FRPSubsequent maturation of the platform introduced reverse-tunnel variants that used open-source proxies like Chisel and FRP to send traffic from infected devices to upstream infrastructure.
Countries
ChinaThe China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been put to use for zero-day exploitation and strategic access.United StatesA defining characteristic of these attacks is the repeated targeting of systems that can open the door to broad visibility, control, and access across large enterprise environments of strategic value to the U.S.
Industries
AviationIT firms, and critical infrastructure such as water, energy, transportation, maritime, rail, aviation, and emergency services.Critical infrastructurecontractors, satellite and mission-critical communication services, universities, IT firms, and critical infrastructure such as water, energy, transportation, maritime, rail, aviation, and emergency services.DefenseHundreds of victims have been identified across telecommunications providers, government, defense contractors, satellite and mission-critical communication services, universities, IT firms, and critical infrastructureEmergency Servicesand critical infrastructure such as water, energy, transportation, maritime, rail, aviation, and emergency services.Energycommunication services, universities, IT firms, and critical infrastructure such as water, energy, transportation, maritime, rail, aviation, and emergency services.GovernmentHundreds of victims have been identified across telecommunications providers, government, defense contractors, satellite and mission-critical communication services, universities, IT firms, and critical infrastructureMaritimeservices, universities, IT firms, and critical infrastructure such as water, energy, transportation, maritime, rail, aviation, and emergency services.railuniversities, IT firms, and critical infrastructure such as water, energy, transportation, maritime, rail, aviation, and emergency services.Satellite communicationshost major military installations, telecommunications infrastructure, defense contractors, satellite communications providers, and critical logistics networks.TelecommunicationsHundreds of victims have been identified across telecommunications providers, government, defense contractors, satellite and mission-critical communication services, universities, IT firms, and critical infrastructureTransportationcommunication services, universities, IT firms, and critical infrastructure such as water, energy, transportation, maritime, rail, aviation, and emergency services.Universitiesproviders, government, defense contractors, satellite and mission-critical communication services, universities, IT firms, and critical infrastructure such as water, energy, transportation, maritime, rail,waterand mission-critical communication services, universities, IT firms, and critical infrastructure such as water, energy, transportation, maritime, rail, aviation, and emergency services.