# Volt Typhoon Leverages Silent Train Network for Zero-Day Exploitation A sophisticated relay infrastructure allows attackers to bypass security filters and maintain persistent access. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-10-29 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/28b913e9-2f49-4fbd-9d45-19ad6919539c ## Silent Train Network Architecture The Silent Train network utilizes disposable relay chains to conceal malicious activity. Attackers route traffic through rented servers and compromised IoT devices, including TP-Link routers and Fortinet appliances. By passing traffic through four to six hops, the group effectively bypasses location-based blocks and IP reputation filters while mimicking legitimate local traffic patterns. ## Operational Discipline and Automation Volt Typhoon maintains strict operational discipline, with human operators working primarily during China Standard Time business hours. The group automates the creation of new relay chains, often building them in under two minutes. They rotate device types monthly, ensuring that compromised infrastructure remains transient and difficult for security teams to track effectively. ## Exploitation of Management Platforms The group specifically targets centralized management platforms like Versa Director, N-able N-central, and Cisco Catalyst SD-WAN. These systems provide broad administrative reach, allowing attackers to manage thousands of downstream devices. By compromising these gateways, Volt Typhoon gains deep access to critical infrastructure without needing to move laterally through traditional network segments. ## Confirmed Zero-Day Campaigns Investigations confirmed the exploitation of at least four zero-day vulnerabilities, including a CVSS 10.0 flaw in Cisco Catalyst SD-WAN. Other targets included Versa Director and N-able N-central. The group also likely exploited a fifth zero-day in Quest KACE, impacting over 30 victims before security updates were released in October 2025. ## Stealth and Forensic Evasion Attackers prioritize stealth by using in-memory webshells and removing all traces of activity after each session. They utilize existing system tools and temporary SSH services to minimize the footprint left on compromised devices. By deleting logs and misusing built-in remote file transfer features, they successfully limit the forensic evidence available to investigators. ## Strategic Targeting Patterns Victims include government agencies, defense contractors, and critical infrastructure sectors like water, energy, and maritime. The geographic concentration in Hawaii, California, and Texas suggests a strategic focus on pre-positioning for potential crises in the Indo-Pacific region. These targets share a common trait: they provide gateways into larger, more sensitive networks. ## Evolution of Attack Methods Since November 2023, the group has evolved from using hijacked routers to more sophisticated, disposable infrastructure. By early 2025, they integrated enterprise platforms and reverse proxies like Chisel and FRP into their operations. This parallel usage of old and new methods demonstrates a high level of resource commitment to maintaining long-term access. ## Defensive Recommendations for Leaders Enterprise leaders must recognize that administrative management platforms are high-value targets. Essential defenses include reducing internet exposure, accelerating patch management cycles, and strengthening access controls. Preserving comprehensive security telemetry is critical for detecting these stealthy, multi-hop relay attacks early and limiting their potential impact on the broader organizational ecosystem. ## Sources covering this story - https://securityaffairs.com/202023/intelligence/volt-typhoon-used-silent-train-to-hide-zero-day-attacks.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._