Volt Typhoon rebuilds Silent Train chains in under two minutes
A two-minute rebuild cycle means the hundreds of notified victims are a floor, not a census.
TL;DR
Black Lotus Labs detailed Silent Train, Volt Typhoon's practice of chaining compromised SOHO routers, IoT devices, and enterprise gear into relay infrastructure it has rotated since late 2023. Researchers say chains rebuild in under two minutes and hundreds of victims have been notified, spanning telecoms, government entities, defense contractors, and critical infrastructure. That rebuild speed keeps the visible node count near zero, so the victim list is a floor, not a census.
The most important number in Lumen's Silent Train report isn't a node count. It's two minutes. That's how fast Volt Typhoon can rebuild a relay chain of compromised devices, according to Black Lotus Labs, and that speed has a consequence: the number of nodes visible at any moment is effectively zero. Individual chains are assembled and dismantled every day. Sessions average roughly four hours, with cleanup and compartmentalization preserving access while defeating enumeration.
The shift became more pronounced after the FBI and DOJ disrupted the KV botnet in early 2024, the report says, and it matches the warning CISA and the UK's NCSC, joined by allied agencies, issued in April about a widespread move toward covert networks of compromised devices. Silent Train is the named example. Black Lotus Labs says it has notified hundreds of victims across telecom, government, defense, and critical infrastructure, and it has catalogued more than 27 device classes, including confirmed zero-day campaigns against Versa Director, N-Able N-Central, Cisco Catalyst SD-WAN, and VeloCloud Orchestrator.
For a defender, the operational lesson isn't about one vendor's patch. It's that hunting against stable infrastructure undercounts an adversary that rebuilds in under two minutes, so CISA's April guidance to map and baseline network edge devices and to know what should be connecting to them is the durable control. Black Lotus Labs is explicit that its observations are not a complete census. The discipline of the rebuild cycle is itself the finding, and it means the real exposure sits above the notified count.
Published ·Deep Fathom