Volt Typhoon's Silent Train: How China's APT Is Using Zero-Days to Pre-Position Inside U.S. Critical Infrastructure
Chinese state-sponsored threat actor Volt Typhoon has been operating a covert relay infrastructure called 'Silent Train' for at least three years, exploiting at least four zero-day vulnerabilities—including CVE-2026-16812 in VeloCloud Orchestrator, CVE-2026-20127 in Cisco Catalyst SD-WAN, CVE-2025-8875/8876 in N-able N-central, and CVE-2024-39717 in Versa Director—to target telecommunications firms, government agencies, defense contractors, utilities, and critical infrastructure providers primarily across California, Texas, and Hawaii. The framework chains compromised SOHO routers and IoT devices as ephemeral relays, with operators erasing all tooling within eight hours of session completion to evade forensic detection while maintaining persistent access to high-value enterprise systems for one to three months. Silent Train represents a significant evolution beyond Volt Typhoon's disrupted KV-Botnet infrastructure, demonstrating the group's adaptive capacity and sustained intent to pre-position within U.S. critical infrastructure ahead of potential geopolitical conflict. The campaign's hybrid use of disposable relays and retained enterprise footholds signals a maturing operational playbook that poses escalating risk to any organization managing edge networking, SD-WAN, or centralized IT management platforms.
Kill Chain
