Volt Typhoon Silent Train: The Hijacked Router Network Behind Zero-Day Attacks on IT Management Tools

Lumen's Black Lotus Labs is a security research team. It says Volt Typhoon, a hacking group the US and allied governments link to the Chinese state, spent nearly three years hiding its attacks behind hijacked home routers, office equipment and business devices. The researchers call that relay system Silent Train. The group used it to break into the management tools companies use to run their networks, including SD-WAN controllers and remote monitoring platforms. If your business or your IT provider runs those tools, this report applies to you.

What is Volt Typhoon's Silent Train?

Silent Train is Lumen's name for a covert network that Volt Typhoon used "to gain and maintain access" to management and control systems. Lumen published its findings this week. According to the report:

• Lumen first saw steady Silent Train activity in November 2023, shortly before the takedown of Volt Typhoon's earlier KV-botnet.
• Each session started from a rented server outside the US, hopped through hacked devices in other countries, then went through hacked US devices before reaching the target. Chains were usually four to six hops long.
• Operators could build a chain in under two minutes. When a session ended, they removed their tools and took the chain apart.
• Lumen counts "more than 27 device classes" used along the way. Named brands include TP-Link, Netgear (including Orbi), Intelbras, Zyxel, Ruckus, Cambium, Fortinet FortiGate and Cisco.

What this means in practice: by the time attack traffic reached a victim, it came from an ordinary-looking address, often a hijacked device in the same country, and that address might never be used again.

Which zero-days did Volt Typhoon exploit?

A zero-day is a flaw attackers use before the vendor has released a fix. Lumen says its monitoring helped identify "one likely and four confirmed zero-day campaigns." The report names these flaws and products:

Those four CVEs plus the suspected KACE flaw plausibly match the "four confirmed and one likely" count, with KACE as the likely one. Lumen does not lay out that mapping itself, so treat it as our reading, not Lumen's statement.

Lumen says targets included telecom providers, government networks, defense contractors, satellite communications firms, managed service providers, and water, energy and transportation operators. It says it sent "hundreds" of victim notifications.

Was Silent Train shut down?

Some coverage says law enforcement disrupted the network. We could not confirm that. Lumen says it "tracked, monitored and quietly disrupted" Silent Train. It does not say how, does not describe a government takedown of Silent Train, and does not say the network is offline. It also says activity "increased after the second disruption." The law enforcement action in the report is the earlier KV-botnet operation, run with US agencies.

What is not known:

• Whether Silent Train is still running, or how many devices it uses now.
• Which router models or firmware versions were abused.
• Indicators of compromise. The report publishes no IP lists, domains or file hashes.

How this fits the CISA covert network advisory

In April 2026, CISA and partners published advisory AA26-113A, "Defending Against China-Nexus Covert Networks of Compromised Devices." It was co-signed by US agencies (CISA, FBI, NSA and the Department of Defense Cyber Crime Center), the UK's NCSC, and agencies from eight other countries: Australia, Canada, Germany, Japan, the Netherlands, New Zealand, Spain and Sweden.

The advisory does not mention Silent Train. It says "the majority of China-nexus threat actors are using these networks," that one network can serve several groups, and that these networks change so fast that fixed IP blocklists are less effective. Silent Train, as Lumen describes it, fits that pattern.

Why it matters for your company network and website

A business can end up in a story like this in two ways.

First, your equipment can be used as a stop in someone else's attack. An old office router, a camera or a firewall with an admin page open to the internet can be borrowed for a few hours and then abandoned. CISA notes the earlier KV-botnet was built mostly from end-of-life routers that no longer got patches.

Second, your management tools can be the target. Volt Typhoon went after the systems that control everything else: SD-WAN, remote monitoring and endpoint management. If your IT provider manages many clients from one platform, one break-in there reaches all of them. Lumen asks organizations to check how their systems and trust relationships could give attackers access to downstream customers or partners.

What to do this week

Volt Typhoon Silent Train questions people are asking

What is Silent Train?

A hidden relay network of hijacked routers, smart devices and business equipment. Lumen says Volt Typhoon used it to hide zero-day attacks on network management tools.

Is Volt Typhoon still active?

Lumen's data runs through at least July 2026, and the report does not say the group has stopped. Assume it is still active.

Did the FBI take down Silent Train?

Not that we could confirm. Lumen says it disrupted the network itself. The government-linked takedown in its report is the earlier KV-botnet.

Could my office router be part of Silent Train?

Possibly, if it is reachable from the internet and unpatched, especially if the vendor no longer supports it. Lumen has not published a device list, so update firmware, turn off remote admin access and replace unsupported hardware.

Do I need to patch anything because of this report?

Yes, if you run Cisco Catalyst SD-WAN, N-able N-central, VeloCloud Orchestrator or Quest KACE. The report does not list fixed versions, so check each vendor's advisory.

The bigger lesson

Attackers like this do not show up from a foreign address you can block. They come through a router down the street, use a flaw nobody has patched yet, and clean up after themselves. Prevention still matters. So does knowing what you have exposed, what normal traffic looks like, and how fast you would notice an admin login at 3 a.m.

For help locking down your network edge, see our security hardening services or request a quote.

Get security alerts like this by email, plus our free checklist, at our security alerts page.

Sources: Lumen Black Lotus Labs: Silent Train; CISA AA26-113A; Cisco advisory cisco-sa-sdwan-rpa-EHchtZk; CISA KEV alert, August 13, 2025.