Overview
- On Wednesday, October 28, 2026, Black Lotus Labs published a three‑year investigation that links the covert framework called Silent Train to the China‑linked group Volt Typhoon.
- Silent Train assembles short‑lived chains that start on overseas VPS servers, pass through compromised SOHO and IoT relays, and exit via U.S.‑based devices to hide the attackers’ origin.
- Researchers tied the framework to at least four confirmed zero‑day campaigns, citing exploits including CVE‑2026‑16812, CVE‑2026‑20127, CVE‑2025‑8875, CVE‑2025‑8876, CVE‑2024‑39717, and a suspected Quest KACE zero‑day.
- Black Lotus Labs has notified hundreds of victims across telecoms, government, defense contractors and critical infrastructure, and CISA and researchers urge reducing internet exposure of admin interfaces, speeding patching, and centralizing logs.
- After law enforcement disrupted the KV‑Botnet, Volt Typhoon moved to ephemeral and later hybrid relay methods that clean up artifacts quickly, which raises the risk that compromise of management and control‑plane tools could give broad downstream access during a crisis.