SILENT-TRAINSilent Train

Covert operational framework reported and named by Lumen Black Lotus Labs, used by Volt Typhoon to gain and maintain access to strategic networks and observed consistently since November 2023, shortly before the first KV-botnet takedown. Black Lotus Labs distinguishes it from traditional botnets, proxy networks and operational relay box (ORB) networks: it is built around rapidly rotating chains of compromised SOHO, IoT and enterprise devices exploited on demand, used against selected targets and dismantled after each operation, across more than 27 device classes including TP-Link, Intelbras, Ruckus, SATO, Netgear, Zyxel, Cambium, Fortinet, Cisco, PRTG, Mirth Connect and CyberPanel. Sessions begin from VPS outside the U.S., chain through compromised non-U.S. devices (Intelbras modems only as overseas relays) and pivot to U.S. devices such as Netgear Orbi or Fortinet FortiGate before the victim, over chained SSH built with temporary SSH services, keys, configuration files and living-off-the-land utilities; operators removed all artifacts and dismantled the chain at the end of each session. By early 2025 it had become a hybrid framework keeping enterprise devices for one to three months, and some operations used reverse tunnels through Chisel and FRP. Reserved for exploitation, credential access, data exfiltration and continued access, it supported at least four confirmed and one likely zero-day exploitation campaigns, including N-able N-central (CVE-2025-8875, CVE-2025-8876), Cisco Catalyst SD-WAN (CVE-2026-20127), VeloCloud Orchestrator (CVE-2026-16812), Versa Director and, with moderate confidence, a Quest KACE zero-day affecting more than 30 victims. Targets include telecommunications providers, defense contractors, government, satellite and mission-critical communications, MSPs and IT firms, universities with military affiliations and critical infrastructure, most often in Hawaii, California and Texas; activity follows China Standard Time working hours. Cisco Talos assesses with high confidence that the infrastructure of UAT-11473 overlaps considerably with Silent Train.