CriticalZero-Day
Chinese Hackers Use Secret Silent Train Network to Exploit Zero-Days Against U.S. Government and Defense
Cyber Security News·Source published ·1 min read
What happened?
China-linked Volt Typhoon hackers have used a covert network called Silent Train to hide zero-day attacks against U.S. government agencies, defense contractors and critical infrastructure. The network chains together compromised routers, connected devices and enterprise servers, helping operators reach sensitive systems while concealing where their activity begins. The investigation connects years of carefully targeted intrusions to attacks on centralized management platforms.
Key details
- China-linked Volt Typhoon hackers operate a covert network named Silent Train to conceal zero-day attacks against U.S. government and defense targets.
- Silent Train chains compromised routers, devices and servers into disposable relay paths that can be assembled in under two minutes and typically last about four hours.
- Attackers exploit centralized management platforms such as N-central, Versa Director, Cisco Catalyst SD-WAN, VeloCloud Orchestrator and Quest KACE to gain broad network access.
- Operators follow a human work schedule, conducting most sessions Monday through Friday between 09:00 and 22:00 China Standard Time, targeting one to five victims per session.
- By early 2025, enterprise systems provided longer-lived final connections lasting one to three months, and some operations used reverse tunnels instead of sequential SSH hops.
- Lumen assesses the activity as positioning access for potential disruption during Indo-Pacific crises rather than evidence that disruption has already occurred.
Affected
- TP-Link routers, Netgear Orbi devices, Fortinet appliances, CyberPanel servers, Intelbras modems and other device classes used as relay nodes.
- N-central management servers (CVE-2025-8875, CVE-2025-8876), Versa Director, Cisco Catalyst SD-WAN (CVE-2026-20127), VeloCloud Orchestrator (CVE-2026-16812) and Quest KACE systems.
- U.S. government agencies, defense contractors, telecommunications companies, satellite communications providers, universities with defense ties and essential service operators.
Fixes and mitigations
- Restrict internet-facing management interfaces, prioritize vendor patches and review downstream trust relationships.
- Export logs, extend retention and investigate unusual administrative activity, API requests, remote transfers and configuration changes.
What to look for
- Temporary SSH services, keys and configuration files installed on compromised devices.
- In-memory webshells such as a JAR webshell on Versa Director that leave minimal disk evidence.
- Reverse-tunnel tools Chisel and FRP observed in Silent Train operations.
- Altered or erased logs on compromised platforms to hide intrusion evidence.
- Sessions originating from virtual private servers outside the U.S., passing through overseas compromised devices, then entering U.S.-based infrastructure.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.