Lumen's Black Lotus Labs published a report on 28 October 2026 about "Silent Train", the relay network that the Chinese state-backed group Volt Typhoon has used since late 2023 to hide its most sensitive attacks. The targets were US government bodies, telecoms, defence contractors and critical infrastructure. The hops in between were often the same kind of hardware that sits in homes and small offices.

Routers as disposable hops

Volt Typhoon's previous tool, the KV botnet, was a long-lived network of hijacked routers that the US authorities and Black Lotus Labs disrupted in late 2023. Silent Train works differently. Each session is built on demand from a chain of devices, used against one to five victims and then taken apart.

A typical chain starts at a rented virtual server outside the US, passes through a second server and several hijacked devices abroad, and leaves through a hijacked device inside the US, so the traffic looks domestic and gets past geo-blocking and IP reputation filters. Some chains had up to six hops.

Black Lotus Labs counted more than 27 device classes. Early chains used SOHO and IoT equipment from TP-Link, Intelbras, Ruckus, SATO, Netgear, Zyxel and Cambium. Each device type had a fixed role: Intelbras modems only appeared as overseas relays, while Netgear Orbi devices served as the US hop that talked to the victim.

How the devices were used

  • The attackers got in through web management interfaces exposed to the internet.
  • They installed only what they needed for chained SSH access: a temporary SSH service, keys, configuration files and tools already on the device.
  • After the session, which lasted about four hours on average, they removed everything and returned the device to its earlier state.
  • A chain could be assembled in under two minutes, which suggests a semi-automated process.

Some relay device types have no known vulnerabilities, so the researchers think the group also used undisclosed flaws to take over a single hop. Later, enterprise systems such as Fortinet and Cisco appliances and PRTG and CyberPanel servers were added as the last hop before the victim, and stayed in use for one to three months. Some sessions also used reverse tunnels through the open-source proxies Chisel and FRP.

What this means for a home network

Silent Train was aimed at large organisations, not households. Through it, Black Lotus Labs found four confirmed and one likely zero-day campaign against management platforms such as Quest KACE, N-Able N-Central, Cisco Catalyst SD-WAN and VeloCloud Orchestrator. But the relays were ordinary routers, and a router that was used for a few hours and then cleaned up leaves its owner little to find.

The basic defence is the same as in Lumen's recommendations for companies: do not expose the router's admin panel to the internet, install firmware updates, and replace devices that no longer get them.