Silent Train shows how Volt Typhoon turned hundreds of routers into a daily rebuilt access network

Lumen Technologies' Black Lotus Labs published findings on October 28, 2026, describing a covert access network it calls Silent Train, attributed to the China-nexus espionage group Volt Typhoon. The research outfit says it tracked the network for three years, generating hundreds of victim notifications in strategically significant sectors and driving incident response investigations that uncovered zero-day exploits used for initial access.

Silent Train is not a standalone botnet. Black Lotus Labs describes it as rapidly rotating chains of compromised small office and home office routers, IoT devices, and enterprise infrastructure, assembled and dismantled daily since late 2023. The group used those chains to exploit additional vulnerabilities, including zero-days, and to support credential access, data exfiltration, and persistent access. Anti-forensic techniques, compartmentalized operations, and post-operation cleanup kept the infrastructure from accumulating into a single takedown target.

The findings follow the U.S. disruption of the KV Botnet, conducted in December 2023 and announced in January 2024. That operation disabled the main arm of Volt Typhoon's staging ground. Silent Train is what came next: a rebuilt access model rather than a rebuilt network.

What makes the campaign notable is where it aimed. Black Lotus Labs says the group targeted endpoint management platforms, network management systems, SD-WAN orchestrators, and control plane technologies, along with entities that could provide scalable access to downstream customers, sensitive networks, or strategic programs. Those are the systems that administer everything else. Compromising an endpoint management server or an SD-WAN orchestrator does not yield one victim; it yields the ability to reach every system those platforms control.

Government officials have described Volt Typhoon as highly sophisticated and as a defining threat, with intrusions into U.S. critical infrastructure since at least 2023.

Several questions remain open.

Reduce internet exposure on management planes.

Patch on an accelerated timeline.

Strengthen access controls.

Preserve telemetry. Rotating infrastructure and post-operation cleanup are designed to erase traces.