GoKawiilLumen's Black Lotus Labs exposes Volt Typhoon's 'Silent Train' relay framework
Black Lotus Labs, Lumen's threat research arm, says it has spent three years tracking a rotating-relay framework it calls Silent Train, used by Chinese state-linked group Volt Typhoon. The group reportedly exploited at least four zero-day vulnerabilities in edge and management infrastructure, routing attacks through overseas VPS servers and chains of hijacked devices like routers to mask their origin before cleaning up after each operation.
GoKawiil's interpretation of the reporting above, not reported fact.
The reported targeting of telecoms, utilities, defense contractors, and emergency services in California, Texas, and Hawaii suggests, according to the researchers, a focus on positioning for potential disruption tied to Indo-Pacific tensions. CISA has previously warned that Volt Typhoon seeks persistent access to critical infrastructure for use in a future crisis, and the researchers suggest the group adapted its relay tactics after the FBI disrupted its earlier KV-Botnet.
- Silent Train is a continuously refreshed relay network of compromised devices used to hide attack origins.
- Volt Typhoon used it alongside at least four zero-day exploits against edge and management infrastructure.
- California, Texas, and Hawaii were the most targeted regions, pointing to possible Indo-Pacific strategic interest.
Firewalla Gold Plus Network Firewall — With state-sponsored actors like Volt Typhoon compromising edge devices and routers to build covert attack infrastructure, having visibility into your own network traffic is more important than ever. Firewalla Gold Plus lets you monitor devices, block suspicious connections, and segment your network, giving home and small-office users enterprise-style defense against these kinds of infiltration tactics.
See Firewalla Gold Plus Network Firewall on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-10-28
Published there as: “Volt Typhoon hides zero-day attacks using 'Silent Train' framework”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.