Volt Typhoon Deployed Silent Train Network for Zero-Day Exploitation
State-sponsored actors utilized ephemeral infrastructure to maintain covert access to critical U.S. systems.
1Silent Train Network Architecture
The China-linked group Volt Typhoon developed a covert, multi-hop framework named Silent Train to facilitate strategic espionage. Identified in late 2023, this network utilizes rotating chains of compromised SOHO, IoT, and enterprise devices. By employing anti-forensic techniques and post-operation cleanup, the actors effectively minimize detection and attribution during critical attack phases.
2Targeting Critical Infrastructure Sectors
Silent Train has impacted hundreds of victims across vital sectors including telecommunications, defense, and government services. The campaign specifically targets water, energy, transportation, maritime, rail, and aviation systems. These intrusions aim to maintain persistent access to environments that support military and civilian operations, particularly during periods of heightened geopolitical tension.
3Ephemeral Operational Security Model
Volt Typhoon shifted from persistent infrastructure to a transient model following the disruption of the KV-botnet. Operators rapidly assemble and dismantle one-time-use chains of compromised devices to protect their access. This framework ensures that even if individual nodes are discovered, the broader operational chain remains secure and compartmentalized from defenders.
4Device Roles and Compartmentalization
The network utilizes at least 27 distinct device classes, ranging from Intelbras modems to Fortinet FortiGate appliances. Specific hardware is assigned fixed roles; for example, Intelbras modems function exclusively as relay nodes, while Netgear Orbi and Fortinet units serve as U.S.-based exit points. This deliberate layering complicates forensic analysis and attribution efforts.
5Zero-Day Exploitation Campaigns
Black Lotus Labs confirmed that Silent Train facilitated four distinct zero-day exploitation campaigns. One notable instance involved the Versa Director file upload vulnerability, CVE-2024-39717, used to deploy the VersaMem web shell. Additionally, the group exploited a vulnerability in Quest KACE, impacting over 30 victims before a patch was released in October 2025.
6Session Management and Cleanup
Operational sessions typically lasted four hours, with some concluding in minutes. Operators deployed temporary SSH services, keys, and configuration files to enable chained access. Upon completing their objectives, they removed all artifacts and dismantled the chain. This discipline prevents the accumulation of long-term indicators of compromise within the victim environments.
7Evolution to Hybrid Infrastructure
By early 2025, the network evolved from a purely ephemeral relay system into a hybrid architecture. This newer model retains enterprise-grade devices for one to three months, providing increased stability. Furthermore, the integration of reverse-tunnel variants using open-source proxies like Chisel and FRP enables more sophisticated traffic routing to upstream infrastructure.
8Strategic Geographic Focus
Operations are heavily concentrated in Hawaii, California, and Texas, states hosting major military installations and defense contractors. This geographic targeting underscores the group's intent to sustain access to consequential networks. The systematic pursuit of control plane technologies demonstrates a long-term strategy to maintain visibility into U.S. critical ecosystems during crises.