Volt Typhoon's Silent Train relays hide zero-day attacks on US and overseas targets
Operators erase their tooling within hours of each session, which makes the intrusions harder to spot and trace after the fact.
Black Lotus Labs, the threat research arm of Lumen, has tracked a Chinese state-linked group, Volt Typhoon, for three years and documented a relay framework it calls Silent Train. The framework chains compromised consumer and enterprise devices, such as Intelbras modems overseas and Netgear Orbi units in the US, and tears down its tooling within about eight hours after each session. Researchers confirmed at least four zero-day flaws exploited through it, in products including Cisco Catalyst SD-WAN, VeloCloud Orchestrator, N-able N-central and Versa Director, with a suspected zero-day in Quest KACE as well. Targets span telecoms, government, defense, utilities, aviation and emergency services, with California, Texas and Hawaii the most hit, which the researchers link to an Indo-Pacific focus. Because the platforms in question grant broad administrative reach, the lesson for operators is to lock down management interfaces, patch quickly, and keep longer log retention.
Why it matters
The campaign shows that attackers can hide inside everyday consumer and enterprise devices, then reach downstream customers through management platforms that grant broad administrative control. For network operators and the public bodies and utilities that depend on them, the risk sits in how such platforms are exposed and how long their logs are kept. The researchers' advice to restrict internet access to administrative interfaces, patch rapidly and retain logs for longer reflects how difficult these intrusions are to detect once tooling has been removed.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.