Lumen Black Lotus Labs research published October 28, 2026; reports October 28 to 29, 2026
Silent Train: Lumen Ties Volt Typhoon to Three Years of Rotating Relay Chains and Four Zero-Day Campaigns
Lumen Technologies Black Lotus Labs has published three years of tracking on a covert relay network it calls Silent Train, which it attributes to the China-based espionage group Volt Typhoon. First detected in late 2023, Silent Train routes attack traffic through rotating chains of compromised small office and home office devices, internet of things devices, and enterprise systems, using temporary SSH access and post-operation cleanup so that little is left on the relays afterward; one account of the research puts tool removal at within about eight hours of an operation. Black Lotus Labs links the network to four confirmed zero-day campaigns against platforms that manage other systems at scale: VeloCloud Orchestrator, Cisco Catalyst SD-WAN, N-able N-central, and Versa Director, with a further suspected zero-day campaign involving Quest KACE. The targets matter more than the count: endpoint management systems, network management systems, and SD-WAN orchestrators and control planes are the key elements of enterprise infrastructure, and compromising one can scale into access to downstream customers and sensitive networks. Black Lotus Labs describes the network supporting exploitation, credential access, and data exfiltration stages, and hundreds of victims have been identified across sectors including telecommunications, government, utilities, managed service providers, and information technology firms, with the most targeted regions reported as California, Texas, and Hawaii.
Executives
The strategic point is patience and position. This infrastructure was built over three years to reach the systems that manage your systems, and it cleans up after itself, so the absence of an alert is weak evidence of absence. The leadership decision is whether management planes, orchestrators, and remote management tools sit at the top of your patching and monitoring priority, where this research says attackers already place them.
CIO / CISO
Work from the target list: VeloCloud Orchestrator, Cisco Catalyst SD-WAN, N-able N-central, Versa Director, and similar control planes should be unreachable from the internet, patched on the vendor clock rather than the monthly cycle, and logged to a system the platform itself cannot alter. Retain those logs long enough to look back over years, not weeks, because the value of this research is a three-year window and short retention quietly deletes your half of it.
Engineers
Hunt for the relay pattern at home and at work: unexpected SSH keys and short-lived SSH access on routers and small office gear, remote administration left enabled on customer premises equipment, and management interfaces answering on public addresses. Keep router and device firmware current, turn off remote admin you do not use, and treat a home router on the path into corporate systems as part of the corporate attack surface.
Everyone (non-IT)
Your home router can be a stepping stone in someone else's attack without anything visibly breaking. Update its firmware, change its default admin password, and turn off remote access from the internet if you do not use it. That ten minutes removes one link from chains like this one.