Volt Typhoon Leverages Silent Train Network for Zero-Day Exploitation
A sophisticated relay infrastructure allows attackers to bypass security filters and maintain persistent access.
1Silent Train Network Architecture
The Silent Train network utilizes disposable relay chains to conceal malicious activity. Attackers route traffic through rented servers and compromised IoT devices, including TP-Link routers and Fortinet appliances. By passing traffic through four to six hops, the group effectively bypasses location-based blocks and IP reputation filters while mimicking legitimate local traffic patterns.
2Operational Discipline and Automation
Volt Typhoon maintains strict operational discipline, with human operators working primarily during China Standard Time business hours. The group automates the creation of new relay chains, often building them in under two minutes. They rotate device types monthly, ensuring that compromised infrastructure remains transient and difficult for security teams to track effectively.
3Exploitation of Management Platforms
The group specifically targets centralized management platforms like Versa Director, N-able N-central, and Cisco Catalyst SD-WAN. These systems provide broad administrative reach, allowing attackers to manage thousands of downstream devices. By compromising these gateways, Volt Typhoon gains deep access to critical infrastructure without needing to move laterally through traditional network segments.
4Confirmed Zero-Day Campaigns
Investigations confirmed the exploitation of at least four zero-day vulnerabilities, including a CVSS 10.0 flaw in Cisco Catalyst SD-WAN. Other targets included Versa Director and N-able N-central. The group also likely exploited a fifth zero-day in Quest KACE, impacting over 30 victims before security updates were released in October 2025.
5Stealth and Forensic Evasion
Attackers prioritize stealth by using in-memory webshells and removing all traces of activity after each session. They utilize existing system tools and temporary SSH services to minimize the footprint left on compromised devices. By deleting logs and misusing built-in remote file transfer features, they successfully limit the forensic evidence available to investigators.
6Strategic Targeting Patterns
Victims include government agencies, defense contractors, and critical infrastructure sectors like water, energy, and maritime. The geographic concentration in Hawaii, California, and Texas suggests a strategic focus on pre-positioning for potential crises in the Indo-Pacific region. These targets share a common trait: they provide gateways into larger, more sensitive networks.
7Evolution of Attack Methods
Since November 2023, the group has evolved from using hijacked routers to more sophisticated, disposable infrastructure. By early 2025, they integrated enterprise platforms and reverse proxies like Chisel and FRP into their operations. This parallel usage of old and new methods demonstrates a high level of resource commitment to maintaining long-term access.
8Defensive Recommendations for Leaders
Enterprise leaders must recognize that administrative management platforms are high-value targets. Essential defenses include reducing internet exposure, accelerating patch management cycles, and strengthening access controls. Preserving comprehensive security telemetry is critical for detecting these stealthy, multi-hop relay attacks early and limiting their potential impact on the broader organizational ecosystem.