Volt Typhoon Uses Silent Train Framework for Zero-Day Attacks

Researchers at Black Lotus Labs have tracked the Silent Train framework for three years. This infrastructure is used by the Chinese state-sponsored hacking group Volt Typhoon to hide zero-day attacks targeting high-value systems. The framework is named for its operational pattern, where threat actors target select victims, clean up after each operation, and continuously refresh the setup. Silent Train functions as a relay network of compromised devices designed to obscure the origin of attacks. Operators route activity through virtual private servers outside the United States before passing it through hacked devices acting as intermediate relays. Intelbras modems served as overseas relays, while Netgear Orbi devices acted as hops within the U.S.

Volt Typhoon exploited at least four zero-day vulnerabilities in attacks targeting edge and management infrastructure. Specific exploits include CVE-2026-16812 in VeloCloud Orchestrator and a suspected zero-day in Quest KACE. The campaign involves exploiting vulnerabilities, stealing credentials, exfiltrating data, and maintaining persistent remote access. Targets include telecommunication firms, government agencies, defense contractors, educational institutes, utilities, satellite service providers, IT firms, MSPs, transportation, aviation, and emergency services. The most targeted regions are California, Texas, and Hawaii. By early 2025, the framework became hybrid, using disposable relays alongside compromised enterprise systems retained for one to three months. Threat actors typically remove all tooling, keys, and configuration files from disposable relays within eight hours of a session ending.