Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns
Lumen Technologies Black Lotus Labs attributed four zero-day exploitation campaigns to Volt Typhoon via a covert access network called Silent Train, which uses rotating chains of compromised SOHO, IoT
Affiliate disclosure: We may earn a commission from qualifying purchases through these links at no additional cost to you. As an Amazon Associate I earn from qualifying purchases.
Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns
Lumen Technologies’ Black Lotus Labs says it attributed four zero-day exploitation campaigns to the China-nexus group Volt Typhoon, linking the activity to a covert access network it calls Silent Train. According to The Hacker News, the network relies on rotating chains of compromised SOHO, IoT, and enterprise infrastructure to hide where attacks are coming from, support anti-forensics, and reduce the chance of detection (The Hacker News, 2026-10-28).
What Black Lotus Labs says it found
The reported campaigns were tied to vulnerabilities in N-able N-central, Cisco Catalyst SD-WAN, and Arista VeloCloud. The findings say Volt Typhoon used the access network to target US critical infrastructure, including telecommunications, defense contractors, and energy sectors (The Hacker News, 2026-10-28).
How Silent Train is described
Black Lotus Labs described Silent Train as a covert infrastructure layer built from compromised devices and systems. The reported model uses rotating chains of SOHO, IoT, and enterprise infrastructure, which is meant to obscure attack origins and make tracking harder. The source also says the operational approach shifted from ephemeral one-time-use infrastructure to a hybrid architecture that keeps enterprise-grade devices in place for longer periods to maintain strategic access to US networks (The Hacker News, 2026-10-28).
Why the reporting matters
If accurate, the report suggests a more durable and layered approach than simple throwaway infrastructure. But the source material provided here attributes the claims to Lumen Technologies Black Lotus Labs and does not independently verify them. The public reporting available in the supplied source presents the activity as an attribution and analysis, not as a court-tested or government-announced conclusion (The Hacker News, 2026-10-28).
Bottom line
The key takeaway is that Black Lotus Labs says Volt Typhoon used Silent Train as a covert access network across four zero-day campaigns, with a focus on US critical infrastructure. The reported pattern combines compromised edge devices, rotating infrastructure, and longer-lived access points, which can make defensive detection and attribution more difficult (The Hacker News, 2026-10-28).
Sources and dates
Research completed: 2026-10-29T05:09:00Z
Affiliate link: we may earn a commission at no additional cost to you. Check current features and terms before signing up.
Building your own website?
This separate resource is for readers creating an online business: Explore Systeme.io. It is an affiliate link, not an Amazon product recommendation.
This article may contain affiliate links. If you purchase through them, we may earn a commission at no additional cost to you.