What the heck is Silent Train?

Meet the cyber equivalent of a secret subway system: a covert access framework built from short-lived, hacked home routers, IoT gadgets, and a handful of enterprise boxes. The China-linked group known as Volt Typhoon assembled this transient infrastructure to quietly move attacks through multiple hops, hide the origin, and vanish before anyone could say “who did that?”.

Key to the setup was a focus on compartmentalized sessions: the operators would assemble a chain of compromised devices, use them for a focused job, then wipe and dismantle everything. Sessions were typically short — often just a few hours, sometimes minutes — and designed to leave as little forensic trace as possible.

How they operated, who they hit, and what got exploited

Rather than a static botnet, the attackers preferred a rotating model: chains of devices from outside the U.S. as staging points, non-U.S. SOHO/IoT relays to obscure the origin, and U.S.-based compromised machines as the final jump into the victim network. The whole thing acted like a multi-hop relay to confound defenders and geofencing checks.

They targeted systems that open wide doors into organizations — think endpoint management platforms, network management systems, SD-WAN controllers, and other control-plane tech. Hundreds of victims were observed across telecoms, government, defense contractors, satellite comms, universities, IT firms, and critical infrastructure (water, energy, transport, maritime, aviation, emergency services).

Notable confirmed zero-day campaigns attributed to this network included exploitation of:

  • CVE-2024-39717 — a file upload flaw used to deliver a custom web shell.
  • CVE-2025-8875 and CVE-2025-8876 — insecure deserialization and command injection flaws in a remote management product.
  • CVE-2026-20127 — an authentication bypass in a prominent SD-WAN controller.
  • CVE-2026-16812 — an OS command injection issue in a popular SD-WAN/orchestration appliance.

There was also credible activity tied to a pre-patch zero-day in a widely used systems management tool that impacted a few dozen victims.

Device-wise, the covert network harvested no fewer than 27 classes of kit. Examples ranged from tiny SOHO routers and consumer mesh nodes to enterprise products and management platforms. Vendors and types observed included consumer routers, modems, wireless access gear, specialized appliances, and enterprise tools like firewalls and monitoring services.

The attackers were intentional about device roles within the chains: some hardware only ever showed up as relays, others as exit points, and some as staging nodes. Over time the setup matured from fully ephemeral relays into a hybrid where selected enterprise devices were held for longer (weeks to a few months) to maintain strategic access.

Operational tweaks included use of reverse tunnels and open-source proxies to channel traffic back to upstream infrastructure, plus temporary SSH services and ephemeral keys deployed just long enough to do the job and then removed.

Geographically, operations focused on places that matter for defense and comms: within the U.S., states that host major military installations, telco hubs, and defense suppliers were prime targets.

  • Silent Train favored short-lived chains and aggressive cleanup to reduce detection.
  • Attackers repeatedly targeted centralized management and control-plane tech to gain broad visibility and persistent downstream access.
  • They used a multi-hop relay model to obscure origin and evade IP reputation and geofencing controls.

Why should you care? Because this is a playbook for getting into the most consequential networks quietly and at scale. The combination of targeted zero-days, deliberate device role assignment, and operational discipline makes it a blueprint that other actors could copy — unless defenders harden the obvious chokepoints and improve monitoring for short-lived lateral tunnels.

If you’re in charge of network or endpoint security, start by treating management platforms and orchestration tools like crown jewels: inventory them, patch aggressively, restrict admin access, and look for unusual short-lived SSH sessions and reverse-tunnel activity. In other words, make the secret subway uncomfortable to ride.