Lumen Says Volt Typhoon Ran Rotating Router Network for Three Years, Notified Hundreds of Victims

Volt Typhoon, the Chinese state-backed hacking group that has been sitting inside U.S. critical infrastructure, ran a second covert access system for roughly three years while the U.S. government publicly celebrated taking down its first one. That is the finding of a report released Wednesday, Oct. 28, by Black Lotus Labs, the threat research arm of Lumen Technologies.

The researchers call the system Silent Train. They say it took shape around November 2023, just weeks before the first round of disruption targeting the group's earlier relay network, the KV Botnet.

How Silent Train works

Silent Train is not a single botnet. It is a method: chains of hijacked home and small-office routers, internet-of-things gadgets and enterprise gear, assembled on demand to hide where an attack comes from.

Black Lotus Labs says operators route traffic through VPS infrastructure outside the United States, then through compromised devices acting as relays. Intelbras modems served as overseas relays. Netgear Orbi devices served as hops inside the U.S.

The speed is the point. "Volt Typhoon demonstrated a repeatable capability to rebuild a new chain with different infrastructure in less than two minutes, making the number of nodes at any one moment effectively close to zero," said Michael Horka, principal information security engineer at Black Lotus Labs and lead researcher on the report.

Sessions averaged roughly four hours, Horka said, and typically ended in under eight. Then the operators wiped the tools they had planted on each hop. Each chain was used once, then discarded.

"That is considerable effort devoted not even to get into their end targets, but purely to making important operations difficult to discover and trace," Horka said.

Four zero-days, hundreds of victims

Black Lotus Labs confirmed that Volt Typhoon used Silent Train in four zero-day campaigns against network edge and management software. One was the Versa Director flaw, CVE-2024-39717, which the group used to deliver a custom web shell called VersaMem that harvested credentials. The other confirmed zero-day campaigns targeted N-able N-Central, Cisco Catalyst SD-WAN and VeloCloud Orchestrator. Horka described the targeted control-plane software as coming from Versa, N-able and VeloCloud, and said all four confirmed zero-days are patched.

Separately, the researchers suspect the group exploited a likely zero-day in Quest KACE before it was patched in October 2025. They estimate that campaign affected more than 30 victims.

Compromise a management platform and you inherit administrative reach into downstream customers, without the noisy lateral movement that trips alarms.

Black Lotus Labs has notified hundreds of victims. They include telecom providers, government agencies, defense contractors, satellite and mission-critical communications firms, universities and IT companies. Critical infrastructure victims span water, energy, transportation, maritime, rail, aviation and emergency services.

The most targeted regions were California, Texas and Hawaii, which the researchers say points to an Indo-Pacific focus.

Horka cautioned against reading the numbers as complete. "The ephemeral nature of the framework means our observations should not be interpreted as a complete census of Volt Typhoon activity," he said.

What the government said, and when

In January 2024, four U.S. cyber and intelligence officials warned publicly that Volt Typhoon was positioning itself inside power grids and transportation networks to be able to sabotage them if the U.S. became involved in a conflict with Beijing over Taiwan. The FBI had conducted an operation in December 2023, announced the following month, that disabled the main arm of the group's earlier staging network, the KV Botnet.

Officials warned at the time that the takedown would not end the campaign. In March 2024, then-NSA cybersecurity director Rob Joyce said investigators were still finding victims.

Black Lotus Labs says Volt Typhoon leaned harder on Silent Train after the FBI and Justice Department disrupted the KV Botnet in early 2024. Earlier this year, U.S. and global authorities warned about a widespread shift among Chinese hacking groups toward covert networks riding on compromised common devices.

Nextgov reported that Energy Department facilities around the country have been targeted over the past year, citing a person with knowledge of the matter. It also cited a former U.S. official who said multiple utility providers have been dealing with Volt Typhoon-related issues over a similar timeframe. Both were granted anonymity to discuss sensitive details of recent intrusions.

The evidence question

Not everyone has taken the government's most dramatic language at face value. Kim Zetter's Zero Day newsletter noted that former FBI Director Christopher Wray called Chinese state hacking groups the "defining threat of our generation," yet researchers and government officials had provided little evidence to support the hyperbolic descriptions of Volt Typhoon as extremely stealthy and ultra-sophisticated. The newsletter said researchers are now finally revealing some of the sophisticated tactics the group has used.

Horka's own assessment is blunt. "This is not something that we have seen before on this scale and not with this level of operational security," he said. He added that the operational structure behind Silent Train is "very, very rare."

What defenders can do

The weak links are mundane: exposed web interfaces on small-office and IoT devices, and management systems reachable from the open internet. Horka's recommended "no-brainer" defenses are keeping logs and cutting internet exposure. Black Lotus Labs also advises strengthening security around centralized management systems, rapidly patching vulnerabilities, centralizing logs with longer retention, and monitoring for unusual administrative activity.

The open question is how many organizations were breached by a chain that no longer exists and left no artifacts behind. Because each chain was dismantled and cleaned up after use, Silent Train is difficult to disrupt. "What exists today will be completely different tomorrow," Horka said.