Researchers say Volt Typhoon hid zero-day attacks behind a rotating network of hijacked devices called Silent Train

Lumen's Black Lotus Labs has published research on Silent Train, a framework it says China's state-sponsored Volt Typhoon group used to hide attacks on high-value systems. Silent Train relies on rotating chains of devices that are compromised on demand, cleaned up after each operation and refreshed continuously. The researchers have tracked it for three years and say Volt Typhoon used it in at least four zero-day campaigns against edge and management infrastructure. Targets included telecommunications firms, government agencies, defense contractors, utilities, satellite service providers, managed service providers and emergency services. The most targeted regions were California, Texas and Hawaii, which the researchers say suggests a focus on Indo-Pacific matters. On the same day, Cisco Talos reported that a group it tracks as UAT-11473, whose infrastructure overlaps with Silent Train, exploited CVE-2026-20127 in Cisco SD-WAN. That flaw has a CVSS score of 10 and was disclosed in February 2026. The group used it to plant KeyDrift, malware designed to harvest encryption keys, on SD-WAN controllers. Talos calls the activity historical and has not said when it happened. The group targets space and satellite services, defense and aerospace, and policy research. Together, the reports show how a disposable relay network can hide state-backed intrusions into the network equipment that sits at the edge of critical organizations.