Lumen's Black Lotus Labs published research on 28 October 2026 on what it calls Silent Train, a covert framework it attributes to the China state-sponsored group Volt Typhoon.

Black Lotus Labs says it has tracked Silent Train for three years, first observing consistent activity in November 2023, shortly before the initial takedown of the KV-botnet, and that the work led to hundreds of victim notifications. It describes Silent Train as rapidly rotating chains of compromised SOHO, IoT and enterprise devices that are exploited on demand, used against selected targets, cleaned up after each operation and continuously refreshed: sessions began from virtual private servers outside the US and were daisy-chained through compromised non-US devices before pivoting within the US to reach targets.

It observed more than 27 device classes used, from TP-Link routers and Netgear Orbi devices to Fortinet appliances and CyberPanel servers, with device types reserved for fixed roles (Intelbras modems only as overseas relays, Netgear Orbi devices as US-based hops that interacted with victims). By early 2025, compromised enterprise platforms were kept in the chains for one to three months, making Silent Train a hybrid framework.

Black Lotus Labs says its monitoring helped uncover at least four confirmed and one likely zero-day campaigns against network and endpoint management systems, SD-WAN orchestrators and other control-plane infrastructure: Versa Director (which it documented in mid-2024), N-able N-central (a chain of then-undisclosed flaws assigned CVE-2025-8875 and CVE-2025-8876), Cisco Catalyst SD-WAN (CVE-2026-20127, exploited from late 2025 and continuing well after Cisco's February 2026 disclosure), VeloCloud Orchestrator (a zero-day later designated CVE-2026-16812) and, assessed with moderate confidence, Quest KACE (more than 30 victims; activity declined after Quest's October 2025 security updates).

Post-incident analysis found in-memory webshells, credential harvesting, abuse of native platform features and, in several cases, erased or altered logs. Victims included telecommunications providers, government, defense contractors, satellite and mission-critical communications services, universities, MSPs, IT firms and critical infrastructure; Hawaii, California and Texas were the most targeted regions. Activity was concentrated on weekdays between 09:00 and 22:00 China Standard Time.

BleepingComputer (28 Oct) also reported the research.