A Lumen research report describes a one-time-use infrastructure model that erases its own traces after every intrusion session.
Intelligence Lead
Black Lotus Labs, the threat intelligence arm of Lumen Technologies, assesses that the China-linked Volt Typhoon group has shifted from persistent infrastructure to disposable relay chains, a framework the researchers call Silent Train. The change erodes the indicators defenders have relied on to detect and attribute pre-positioned access in US defence, telecommunications and critical infrastructure networks. Victims are reported to number in the hundreds over more than three years.
Situation Report
Lumen published the Silent Train report on 29 October. According to secondary coverage, the framework builds a relay chain of typically four to six hops, running from foreign virtual private servers through compromised small-office and IoT devices abroad to a US-based device and then the target. Each chain is reportedly assembled in under two minutes, used for a session averaging about four hours, then dismantled. Operators are described as removing temporary SSH keys, configuration files, log entries and tooling at session end, restoring devices to their prior state.
The researchers also report four zero-day campaigns against network and systems management platforms: Versa Director, N-able N-central, Cisco Catalyst SD-WAN Controller and Arista VeloCloud Orchestrator. A fifth, against Quest KACE, is assessed with moderate confidence. The Cisco flaw is reported as a maximum-severity authentication bypass whose exploitation continued after public disclosure earlier this year. Some CVE details appear in a single secondary source and have not been independently verified.
Reported targets include US government agencies, defence contractors, telecommunications and satellite providers, managed service providers, and universities with military research ties. Hawaii, California and Texas are described as the most-targeted states. Black Lotus Labs researcher Mike Horka told journalist Kim Zetter the activity had not been seen "on this scale and not with this level of operational security," and that exfiltrated material included documents on military operations and network structures. No new US government response or Chinese comment has been reported.
Background & Context
Volt Typhoon entered public view in 2023 when Microsoft and Five Eyes agencies warned of Chinese pre-positioning in US critical infrastructure using living-off-the-land techniques, relying on legitimate administrative tools rather than custom malware. In January 2024 the US Justice Department disrupted the KV-Botnet, a network of compromised small-office routers used to mask that activity.
Silent Train appears to be the successor tradecraft. Persistent botnets can be mapped, sinkholed and seized; ephemeral chains leave little to map. The reported role-fixed device selection, with specific consumer modems as overseas relays and specific firewall models as US final hops, suggests an industrialised, partly automated process rather than ad hoc operator choices.
Analysis & Assessment
Assessed with moderate confidence, the shift reflects adaptation to the 2024 disruption: the operators have moved the contest from infrastructure that can be seized to management planes that are rarely monitored. Compromising SD-WAN controllers and remote-management tools gives access to many downstream networks at once, which is consistent with an objective of broad, durable positioning rather than immediate data theft.
The attribution picture carries caveats. The reporting rests largely on one vendor's telemetry and its secondary coverage, with only the Quest KACE link carrying an explicit confidence rating. The claim that the access serves a Taiwan contingency is a long-standing US official assessment, not a finding of this report. Defenders should expect lower detection yield from network-indicator blocking, and a greater premium on patching management platforms, logging at the management plane, and hunting for short-lived administrative sessions.