Volt Typhoon, the hacking group U.S. officials have linked to the Chinese state, spent about three years routing intrusions through constantly rebuilt chains of hijacked routers and devices to reach U.S. government agencies, defense contractors and critical infrastructure operators, researchers at Lumen Technologies said Wednesday, Nextgov/FCW reported. For organizations, it means hostile traffic can arrive from an ordinary-looking U.S. address, weakening defenses that block traffic by location or reputation.
What Happened
Lumen's threat intelligence unit, Black Lotus Labs, calls the framework "Silent Train." In vendor research published Wednesday, it says the network began to take shape around November 2023 and that use grew after the FBI and Justice Department disrupted Volt Typhoon's earlier KV botnet, a network of hijacked routers. Silent Train is not one standing network but a series of short-lived chains: traffic starts at a rented server outside the U.S., hops through compromised home and small-office routers and internet-connected devices abroad, and exits through a compromised U.S. device.
Lumen says operators could assemble a chain in under two minutes, with sessions averaging about four hours before cleanup. It counted more than 27 classes of abused devices, including TP-Link and Netgear routers and Fortinet appliances.
The monitoring helped uncover at least four confirmed zero-day campaigns and one likely one, Lumen says. A zero-day is a flaw attackers exploit before a fix exists. The products hit were Versa Director, N-able N-central, Cisco Catalyst SD-WAN, VeloCloud Orchestrator and, likely, Quest KACE, where Lumen estimates more than 30 victims. Black Lotus Labs says it notified hundreds of victims. Hawaii, California and Texas were the most frequently targeted states.
Cisco's Talos research unit separately said Wednesday that a group it tracks as UAT-11473 exploited CVE-2026-20127, a maximum-severity flaw in Cisco's SD-WAN controllers, to plant malware called KeyDrift that steals encryption key material. Talos assessed with high confidence that the group's infrastructure "overlaps considerably with" Silent Train, but it did not say the two groups are the same, SecurityWeek reported.
Why It Matters
Every Silent Train zero-day campaign targeted management or control-plane platforms, Lumen says. These consoles configure an organization's network or computer fleet, so one compromise reaches everything downstream. Black Lotus Labs researcher Michael Horka told journalist Kim Zetter that the hackers also took documents on military operations and network structures, SecurityWeek reported.
Because each chain ends on a domestic device and soon disappears, blocklists and geographic filtering offer little protection. Horka said the framework is hard to disrupt "because there isn't one network to take down," CyberScoop reported.
Context
U.S. officials warned publicly in early 2024 that Volt Typhoon had embedded itself in critical infrastructure and was positioning to sabotage power and transportation networks in a conflict over Taiwan, Nextgov/FCW noted. Unnamed sources told Nextgov/FCW that Energy Department facilities were targeted over the past year.
What to Watch
Watch for U.S. government advisories on Silent Train, disclosure of the Quest KACE flaw and word on when the KeyDrift intrusions occurred, which Talos has not said. Horka cautioned that the observations are "not a complete census" of Volt Typhoon activity.
