Researchers at Lumen's Black Lotus Labs have exposed a relay framework called Silent Train, linked to the China-linked hacking group Volt Typhoon and said to hide four zero-day attack campaigns. The report, published on 28 October 2026, describes a network built not from servers the attackers own, but from chains of compromised small-office routers, connected devices and enterprise systems that are assembled for an operation and then dismantled. Black Lotus Labs says it has notified hundreds of victims across telecoms, government, defence, universities and critical infrastructure.

A network built to disappear

Silent Train has been tracked since late 2023 and grew in importance after US authorities disrupted Volt Typhoon's earlier KV Botnet in early 2024, according to the researchers. Individual chains are put together and taken apart daily, with sessions averaging about four hours, and the researchers say a fresh chain can be rebuilt in under two minutes. That speed, plus wiping tools and traces after each session, leaves defenders with almost no standing infrastructure to block or take down. The researchers also report more than 27 device classes abused in the network, with particular device types reserved for particular positions in each chain.

Four campaigns against management platforms

The four confirmed campaigns all targeted platforms that manage whole networks rather than single computers: Versa Director, N-able N-central, Cisco Catalyst SD-WAN and Arista VeloCloud Orchestrator. All four vendors have released fixes, although Lumen observed exploitation of the Cisco flaw continuing after its February 2026 disclosure. The researchers' advice is practical: keep management interfaces off the public internet, patch management platforms quickly, keep centralised logs for longer, and watch for unusual administrative activity. Attribution to Volt Typhoon is the researchers' assessment, and the report itself cautions that its observations are not a complete census of the group's activity.

Sources: Cybernoz (Lumen Black Lotus Labs report), Cryptopolitan.