Chinese state-linked hacking group Volt Typhoon is associated with a covert access framework called “Silent Train,” which uses networks of compromised everyday devices to support infiltration. Reporting from multiple outlets, citing work by Lumen Technologies’ Black Lotus Labs, says the activity began to be identified in late 2023 and involves rapid rotation across chains of victim devices.
Across sources, “Silent Train” is described as an ephemeral, anti-forensics approach in which attackers move between compromised SOHO routers, IoT devices, and some enterprise infrastructure to make tracing harder. The framework is also said to enable credential harvesting and data theft, and to support longer-term access by keeping footholds inside networks.
Several outlets add that the framework has been used in campaigns involving zero-day exploitation. Coverage also emphasizes that targets include networks tied to sensitive U.S. sectors such as telecom and government, along with defense contractors and systems associated with services like water, energy, and transport. While the overall picture aligns, outlets differ in how much they foreground the zero-day element versus the broader “quiet hijacking” and device-rotation tactics.
