Silent Train: Volt Typhoon’s disposable relay for zero-day access

Lumen Black Lotus Labs has published a three-year look at Silent Train, the relay framework it assesses Volt Typhoon used to hide zero-day exploitation of enterprise control-plane platforms. This explainer covers what Silent Train is, the four confirmed campaigns, how it differs from ORBs and botnets, and what to hunt on SOHO and edge gear.

What Silent Train is

Black Lotus Labs describes Silent Train as a layered, multi-hop relay of rapidly rotating compromised SOHO, IoT and enterprise devices. Sessions typically start on non-US virtual private servers, daisy-chain through overseas relays, exit via a US-based hop, then hit the target. Operators assemble the chain for a short job — often hours, sometimes minutes — then tear it down and scrub artefacts. Consistent activity was first seen in November 2023, as Volt Typhoon moved away from the disrupted KV-botnet towards disposable infrastructure.

The framework was reserved for high-value phases: exploitation, credential access, exfiltration and sustained engagement — not day-to-day scanning. Session timing clustered Monday to Friday, roughly 09:00–22:00 China Standard Time, which Black Lotus Labs reads as hands-on operators rather than an always-on botnet.

Four confirmed zero-day campaigns (and one likely)

Monitoring Silent Train, Black Lotus Labs reports, helped surface four confirmed and one likely zero-day campaigns against management and SD-WAN control planes. Compromising those platforms buys admin reach across many downstream devices without noisy lateral movement.

Not a botnet, not a classic ORB

A conventional botnet is a long-lived herd that keeps checking in to the same controllers. An operational relay box (ORB) network is a pool of compromised devices used mainly to bounce traffic and hide the operator — often shared across jobs and left standing longer. Silent Train, on this assessment, is a disposable access corridor: devices are exploited on demand, given fixed roles in a short chain (for example Intelbras overseas, Netgear Orbi as a US exit), used against one or a handful of victims, then cleaned. Enterprise gear such as Fortinet later appeared as longer-lived final hops; some sessions mixed reverse tunnels (Chisel, FRP) with SSH chaining. Hunting only for persistent C2 will miss these short-lived chains.

Why it matters globally

Reported victimology centres on US telecommunications, government, defence, MSPs, universities and critical infrastructure, with concentration in California, Texas and Hawaii. The technique travels: any organisation that exposes SD-WAN orchestrators, endpoint-management consoles or out-of-band admin planes sits in the same target class. Five Eyes guidance already framed Volt Typhoon as pre-positioning on IT for potential disruption in a crisis (CISA/NSA/FBI and partners, AA24-038A (opens in a new tab); NCSC-UK partner warning (opens in a new tab)). Silent Train is the access fabric Black Lotus Labs says sat behind several high-value control-plane breaches. For OT-linked context, see our primer OT Security 101.

SOHO and edge relay hunting

The public Silent Train write-up ships no hash or domain IOC pack for the relay fabric. Hunt behaviour, plus vendor IOCs for the control-plane CVEs:

• Unexpected outbound from edge and SOHO gear — new SSH listeners, reverse tunnels, or sustained outbound HTTPS/SSH from routers and mesh nodes that never initiated such sessions. Watch temporary proxy tooling (Chisel, FRP) on unusual high ports.
• Management-plane logins from residential or consumer ASN space — admin UI, API or NETCONF/SSH to orchestrators and UEM consoles from SOHO egress rather than known jump hosts or corporate VPN.
• NetFlow / flow records — short-lived multi-hop patterns (overseas VPS → SOHO → US edge → your management plane), then silence. Sessions that work for under a working day and vanish beat steady low-and-slow C2 as a lead.
• Config and integrity on edge devices — new SSH keys, temporary accounts, altered port-forwards, unexpected remote-admin enablement, or logs wiped after a short activity window.
• Control-plane forensics — for VeloCloud, Arista SA-0144 lists observed attack sources (defanged): 8[.]19[.]75[.]217, 206[.]72[.]242[.]124, 206[.]72[.]242[.]162. Hunt unexpected outbound from the orchestrator, privileged actions outside change windows, and in-memory webshells on Versa-class platforms.

Example Microsoft Sentinel starting point for management-plane sign-ins from non-corporate networks (tune the allow-list to your estate):

SigninLogs
| where TimeGenerated > ago(14d)
| where AppDisplayName has_any ("vManage", "SD-WAN", "VeloCloud", "N-central", "Versa", "KACE")
    or ResourceDisplayName has_any ("vManage", "Orchestrator", "N-central")
| where ResultType == 0
| where NetworkLocationDetails !has "corporate"
| summarize Attempts=count(), Apps=make_set(AppDisplayName) by IPAddress, Location, UserPrincipalName
| order by Attempts desc

Pair with inventory: management interfaces behind VPN or jump hosts, patched to the fixed trains above, and logged where the appliance cannot wipe the trail.

Sources

• Lumen Black Lotus Labs — Silent Train (opens in a new tab) (28 October 2026)
• BleepingComputer summary (opens in a new tab) (28 October 2026)
• Vendor advisories: Versa CVE-2024-39717 (opens in a new tab); N-able N-central 2025.3.1 / 2024.6 HF2; Cisco CVE-2026-20127 (opens in a new tab); Arista SA-0144 (CVE-2026-16812) (opens in a new tab)
• CISA KEV (opens in a new tab); AA24-038A (opens in a new tab); AA23-144A (opens in a new tab); NCSC-UK Volt Typhoon warning (opens in a new tab)

Follow Cyber-Threat.net RSS · Feedly (opens in a new tab) · X (opens in a new tab) · Bluesky (opens in a new tab) · LinkedIn (opens in a new tab)