Lumen Technologies' Black Lotus Labs has published findings on a covert operational relay network it tracks as Silent Train, attributed to Volt Typhoon — the China-linked advanced persistent threat group that has maintained persistent access to U.S. critical infrastructure since at least 2021. According to Lumen's three-year tracking effort, Silent Train is not a conventional botnet. It is a dynamic chain of disposable relay nodes — compromised SOHO routers, edge appliances, and IoT devices — that Volt Typhoon uses to obscure the origin of its attacks, including exploitation of at least four zero-day vulnerabilities against critical systems.
This matters for defenders because Volt Typhoon's operational model is specifically engineered to defeat network-level detection. The group does not maintain command-and-control domains that can be sinkholed or IP addresses that can be blocklisted. Instead, it routes attack traffic through chains of compromised consumer and small-business devices, each used briefly and discarded. By the time a defender identifies a relay node, the threat actor has already rotated to the next one. The result is that traditional IOC-based detection — the backbone of most SOC playbooks — is largely ineffective against this campaign.
If your organization operates critical infrastructure, manages edge network devices, or falls within sectors Volt Typhoon has historically targeted (communications, energy, water, transportation), this report should trigger an immediate review of your edge device security posture and your ability to detect anomalous traffic patterns that do not match known-bad indicators.
Technical Analysis
What Is Silent Train?
Silent Train is a covert relay infrastructure composed of compromised SOHO routers, VPN appliances, firewalls, and other internet-facing edge devices. Unlike traditional botnets such as Mirai or Emotet, Silent Train is not designed for DDoS or spam distribution. Its sole purpose is to serve as an operational relay box (ORB) network — a chain of intermediate nodes through which Volt Typhoon funnels exploitation traffic, C2 communications, and data exfiltration.
The defining characteristics of Silent Train, as documented by Black Lotus Labs:
- Disposable relay chains: Individual compromised devices are used for short windows — sometimes hours, sometimes days — and then abandoned. This creates a constantly shifting attack infrastructure that resists IP-based blocking.
- Chained relaying: Attack traffic is routed through multiple compromised devices in sequence, making it nearly impossible to trace back to the original source through NetFlow analysis alone.
- Legitimate device abuse: The relay nodes are not attacker-owned servers. They are legitimate devices owned by consumers and small businesses that have been silently compromised. This means attack traffic originates from residential IP space and benign-looking ASNs, bypassing most geographic and reputation-based filtering.
- Living-off-the-land on edge devices: Volt Typhoon does not typically deploy persistent malware on relay nodes. Instead, it leverages built-in device capabilities — SSH daemons, cron jobs, iptables rules, and native proxying — to forward traffic. This leaves minimal forensic artifacts.
Zero-Day Exploitation via Silent Train
Black Lotus Labs has linked Silent Train relay infrastructure to exploitation of at least four zero-day vulnerabilities. While the specific CVEs were not disclosed in the summary reporting, Volt Typhoon's known modus operandi — corroborated by prior CISA advisories and industry research — centers on exploiting unpatched vulnerabilities in internet-facing edge devices from vendors including Cisco, Fortinet, Ivanti, and TP-Link. These devices are attractive targets because they:
- Sit at the network perimeter with broad visibility into internal traffic
- Run embedded operating systems that rarely support endpoint detection agents
- Are frequently left unpatched for extended periods due to maintenance window constraints or vendor neglect
- Often lack centralized logging, making post-compromise forensics extremely difficult
The attack chain typically follows this pattern:
- Initial access: Exploitation of an unpatched vulnerability (zero-day or N-day) in an internet-facing edge device — SOHO router, VPN concentrator, or firewall.
- Relay configuration: The compromised device is configured as a traffic relay, either through native port forwarding, SSH tunneling, or lightweight proxying. No traditional malware is deployed.
- Attack staging: Volt Typhoon routes exploitation traffic through the Silent Train relay chain to target high-value critical infrastructure systems. The source IP seen by the target is the last relay node — a compromised home router, not an attacker-controlled server.
- C2 and exfiltration: Post-exploitation communications are similarly relayed through the chain, often using legitimate protocols (HTTPS, DNS, ICMP) to blend with normal traffic.
- Node rotation: Relay nodes are abandoned and replaced regularly. Forensic analysis of a single node yields limited intelligence because the full chain is never visible from any single point.
Exploitation Status
This is confirmed active exploitation by a nation-state threat actor against U.S. critical infrastructure. Lumen's Black Lotus Labs has been tracking Silent Train for three years, indicating sustained, ongoing operations. CISA has issued multiple advisories on Volt Typhoon's activity, including joint guidance with NSA, FBI, and international partners warning of pre-positioning for potential disruptive attacks against critical infrastructure.
Detection & Response
Detecting Volt Typhoon's Silent Train activity requires a shift from IOC-based detection to behavioral and anomaly-based detection, particularly at the network edge. The following rules and queries target observable behaviors associated with ORB network abuse and edge device compromise.
Sigma Rules
---
title: Suspicious Outbound Connection from Edge Network Device Process
description: Detects unexpected outbound network connections from processes running on network edge devices, which may indicate compromise and use as an operational relay node consistent with Volt Typhoon Silent Train TTPs.
references:
- https://securityaffairs.com/202023/intelligence/volt-typhoon-used-silent-train-to-hide-zero-day-attacks.html
- https://attack.mitre.org/techniques/T1090/
author: Security Arsenal
date: 2026/04/07
status: experimental
tags:
- attack.command_and_control
- attack.t1090
logsource:
category: network_connection
product: linux
detection:
selection_process:
Image|endswith:
- '/bin/busybox'
- '/usr/sbin/dropbear'
- '/usr/sbin/sshd'
- '/bin/iptables'
- '/sbin/iptables'
selection_destination:
DestinationIp|cidr:
- '!10.0.0.0/8'
- '!172.16.0.0/12'
- '!192.168.0.0/16'
- '!127.0.0.0/8'
condition: selection_process and selection_destination
falsepositives:
- Legitimate firmware update checks
- NTP synchronization if not filtered separately
- Vendor telemetry or cloud management agents
level: high
---
title: SSH Tunneling or Port Forwarding on Edge Device
description: Detects SSH local/remote port forwarding or dynamic SOCKS proxying initiated on Linux-based systems, a technique used by Volt Typhoon to create covert relay chains through compromised edge devices without deploying traditional malware.
references:
- https://securityaffairs.com/202023/intelligence/volt-typhoon-used-silent-train-to-hide-zero-day-attacks.html
- https://attack.mitre.org/techniques/T1572/
author: Security Arsenal
date: 2026/04/07
status: experimental
tags:
- attack.command_and_control
- attack.t1572
- attack.t1090.001
logsource:
category: process_creation
product: linux
detection:
selection:
CommandLine|contains:
- 'ssh -L '
- 'ssh -R '
- 'ssh -D '
- 'ssh -N -L'
- 'ssh -N -R'
- 'ssh -N -D'
- 'ssh -f -N -L'
- 'ssh -f -N -R'
- 'ssh -f -N -D'
filter_legitimate_admin:
User|contains:
- 'netadmin'
- 'sysadmin'
condition: selection and not filter_legitimate_admin
falsepositives:
- Legitimate SSH tunneling by network administrators for remote management
- Development or debugging activity on engineering workstations
level: high
---
title: Unexpected Cron or Init Persistence on Embedded Linux Device
description: Detects creation or modification of cron jobs and init scripts on Linux systems, a common persistence mechanism used by Volt Typhoon on compromised edge devices to maintain relay functionality across reboots without deploying malware implants.
references:
- https://securityaffairs.com/202023/intelligence/volt-typhoon-used-silent-train-to-hide-zero-day-attacks.html
- https://attack.mitre.org/techniques/T1053/003/
- https://attack.mitre.org/techniques/T1037/
author: Security Arsenal
date: 2026/04/07
status: experimental
tags:
- attack.persistence
- attack.t1053.003
- attack.t1037
logsource:
category: file_event
product: linux
detection:
selection:
TargetFilename|startswith:
- '/etc/cron.d/'
- '/etc/cron.daily/'
- '/etc/cron.hourly/'
- '/etc/init.d/'
- '/etc/rc.d/'
- '/var/spool/cron/'
- '/etc/systemd/system/'
filter_system:
TargetFilename|contains:
- 'logrotate'
- 'apt-'
- 'dpkg'
- 'man-db'
- 'sysstat'
condition: selection and not filter_system
falsepositives:
- Legitimate software installation creating service entries
- Configuration management tools (Ansible, Puppet, Chef)
level: medium
KQL — Microsoft Sentinel Hunt Query
The following query hunts for anomalous outbound connections from network edge devices ingested via Syslog or CEF, focusing on devices that are initiating connections they historically have not made — a key indicator of relay node abuse.
// Hunt for edge devices making anomalous outbound connections
// Targets Silent Train relay behavior: edge devices proxying traffic to external destinations
let lookback = 14d;
let baseline_period = 30d;
// Step 1: Build baseline of known outbound connections from network devices
let baseline = CommonSecurityLog
| where TimeGenerated > ago(baseline_period) and TimeGenerated <= ago(lookback)
| where DeviceVendor in ("Cisco", "Fortinet", "Palo Alto Networks", "Juniper", "TP-Link", "Ubiquiti", "Netgear", "MikroTik", "Ivanti", "SonicWall")
| where isnotempty(DestinationIP)
| summarize by SourceIP, DestinationIP, DestinationPort;
// Step 2: Find new outbound connections not in baseline
CommonSecurityLog
| where TimeGenerated > ago(lookback)
| where DeviceVendor in ("Cisco", "Fortinet", "Palo Alto Networks", "Juniper", "TP-Link", "Ubiquiti", "Netgear", "MikroTik", "Ivanti", "SonicWall")
| where isnotempty(DestinationIP)
| extend DestIPStr = tostring(DestinationIP)
| where not(DestIPStr startswith "10." or DestIPStr startswith "172.16." or DestIPStr startswith "192.168.")
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), DistinctDestinations = dcount(DestinationIP) by SourceIP, DeviceProduct, DestinationPort
| where DistinctDestinations > 20 or DestinationPort in (22, 443, 8080, 8443, 9050)
| project FirstSeen, LastSeen, SourceIP, DeviceProduct, DestinationPort, DistinctDestinations, ConnectionCount
| order by DistinctDestinations desc;
Velociraptor VQL Hunt Artifact
This VQL artifact hunts for evidence of SSH tunneling, unexpected listening services, and persistence mechanisms on Linux-based edge devices and servers that may have been conscripted into a Silent Train relay chain.
-- Hunt for SSH tunneling processes, unexpected listeners, and persistence on Linux edge devices
-- Targets Volt Typhoon Silent Train relay node indicators
-- Part 1: Check for SSH processes with tunneling flags
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'ssh.*-[LRD]\\s'
OR CommandLine =~ 'ssh.*-f.*-N'
OR CommandLine =~ 'autossh'
-- Part 2: Check for unexpected listening services on common relay ports
SELECT Pid, Name, LocalAddr, LocalPort, RemoteAddr, RemotePort, Status
FROM netstat()
WHERE Status = 'LISTEN'
AND LocalPort IN (22, 443, 1080, 8080, 8443, 9050, 3128)
AND NOT LocalAddr =~ '^127\\.'
-- Part 3: Check cron and init persistence locations for recent modifications
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['/etc/cron.d/*', '/etc/cron.daily/*', '/etc/init.d/*', '/etc/systemd/system/*.service', '/var/spool/cron/crontabs/*'])
WHERE Mtime > now() - (14 * 24 * 3600)
ORDER BY Mtime DESC
Remediation and Hardening Script
The following Bash script is designed for Linux-based edge devices and network appliances where shell access is available. It audits for indicators of compromise consistent with Silent Train relay node abuse and applies baseline hardening.
#!/bin/bash
# volt_typhoon_edge_audit.sh
# Audit and harden Linux-based edge devices against Silent Train relay abuse
# Run as root or with sudo
echo "=========================================="
echo " Volt Typhoon / Silent Train Edge Audit"
echo " $(date)"
echo "=========================================="
echo ""
echo "[1] Checking for active SSH tunnels and forwarded connections..."
ps aux | grep -E 'ssh.*-[LRDfN]' | grep -v grep
if [ $? -eq 0 ]; then
echo " [!] WARNING: SSH tunneling processes detected. Investigate immediately."
else
echo " [OK] No suspicious SSH tunnel processes found."
fi
echo ""
echo "[2] Checking for unexpected listening services..."
ss -tlnp | awk 'NR>1 {print $4, $6, $7}' | while read addr port proc; do
portnum=$(echo "$addr" | awk -F: '{print $NF}')
case "$portnum" in
22|80|443|53|161|8080|8443|1080|3128|9050)
echo " [INFO] Listener on port $portnum — $proc"
;;
esac
done
echo ""
echo "[3] Checking iptables for forwarding or NAT rules (relay indicators)..."
iptables -t nat -L -n -v 2>/dev/null | grep -E '(DNAT|SNAT|MASQUERADE|REDIRECT)'
if [ $? -eq 0 ]; then
echo " [!] WARNING: NAT/forwarding rules found. Verify these are intentional."
iptables -t nat -L -n -v 2>/dev/null
else
echo " [OK] No unexpected NAT rules detected."
fi
echo ""
echo "[4] Checking recently modified cron and init files (last 14 days)..."
find /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/init.d /etc/systemd/system /var/spool/cron -mtime -14 -type f 2>/dev/null | while read f; do
echo " [REVIEW] $f (modified: $(stat -c '%y' "$f" 2>/dev/null))"
done
echo ""
echo "[5] Checking for unauthorized SSH authorized_keys modifications..."
find / -name "authorized_keys" -mtime -30 2>/dev/null | while read f; do
echo " [REVIEW] $f (modified: $(stat -c '%y' "$f" 2>/dev/null))"
echo " Contents:"
cat "$f" 2>/dev/null | head -5
echo ""
done
echo ""
echo "[6] Checking for established outbound connections to non-RFC1918 addresses..."
ss -tnp state established 2>/dev/null | awk 'NR>1 {print $4, $5, $6}' | grep -v '^\s*$' | while read local remote proc; do
remote_ip=$(echo "$remote" | awk -F: '{print $1}')
if ! echo "$remote_ip" | grep -qE '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.|169\.254\.)'; then
echo " [REVIEW] $local -> $remote ($proc)"
fi
done
echo ""
echo "[7] Hardening: Disabling IP forwarding if not required..."
current_fwd=$(cat /proc/sys/net/ipv4/ip_forward 2>/dev/null)
if [ "$current_fwd" = "1" ]; then
echo " [!] IP forwarding is ENABLED. If this device should not route traffic, disable it:"
echo " sysctl -w net.ipv4.ip_forward=0"
echo " echo 'net.ipv4.ip_forward=0' >> /etc/sysctl.conf"
echo ""
read -p " Disable IP forwarding now? (y/n): " confirm
if [ "$confirm" = "y" ]; then
sysctl -w net.ipv4.ip_forward=0
echo 'net.ipv4.ip_forward=0' >> /etc/sysctl.conf
echo " [DONE] IP forwarding disabled."
fi
else
echo " [OK] IP forwarding is disabled."
fi
echo ""
echo "[8] Checking firmware/software version currency..."
if command -v uname &>/dev/null; then
echo " Kernel: $(uname -r)"
fi
if [ -f /etc/os-release ]; then
echo " OS: $(grep PRETTY_NAME /etc/os-release | cut -d= -f2 | tr -d '"')"
fi
echo " [!] ACTION REQUIRED: Verify with your vendor that firmware is at the latest version."
echo " [!] Check for pending security patches addressing known vulnerabilities."
echo ""
echo "=========================================="
echo " Audit complete. Review all [WARNING] and [REVIEW] items."
echo " Report suspected compromise to your IR team and CISA (report@cisa.gov)."
echo "=========================================="
Remediation
Defending against Volt Typhoon's Silent Train requires a layered approach that addresses both your own edge device security and your ability to detect relayed attack traffic.
Immediate Actions
-
Inventory and patch all internet-facing edge devices. Enumerate every SOHO router, firewall, VPN appliance, and IoT device with an internet-facing management interface. Apply all outstanding firmware updates from the vendor. Volt Typhoon specifically targets unpatched devices — reducing your unpatched attack surface is the single most effective countermeasure. Prioritize devices from vendors with known Volt Typhoon exploitation history: Cisco, Fortinet, Ivanti, TP-Link, Netgear, and SonicWall.
-
Disable unused management interfaces and services. If remote management is not operationally required, disable WAN-side management on all edge devices. Where remote management is necessary, restrict it to specific source IPs, enforce strong authentication (preferably certificate-based), and log all management plane access.
-
Audit edge devices for compromise indicators. Run the audit script above or equivalent checks on all Linux-based network appliances. Look specifically for unauthorized SSH keys, unexpected cron entries, NAT/forwarding rules you did not configure, and processes initiating outbound connections to unfamiliar destinations.
-
Implement egress filtering and monitoring. Deploy egress filtering at your network boundary to alert on edge devices initiating connections to external IP addresses they have not historically communicated with. This is the most reliable detection method for relay node abuse because it does not depend on IOCs.
-
Reset credentials on all edge devices. If you cannot conclusively determine whether a device has been compromised, perform a factory reset, update to the latest firmware, and reconfigure from scratch with strong, unique credentials. Volt Typhoon is known for stealing credentials and using them to regain access after initial eviction.
Strategic Hardening
- Segment edge devices from critical infrastructure. Edge devices should sit in a DMZ with strict access control lists limiting what they can reach internally. A compromised relay node should not provide a pathway to operational technology or sensitive internal systems.
- Deploy network detection and response (NDR) capabilities that can baseline normal traffic patterns for edge devices and alert on behavioral deviations. Volt Typhoon's living-off-the-land approach means endpoint agents will not catch them — network visibility is essential.
- Subscribe to CISA advisories and Lumen Black Lotus Labs research. Volt Typhoon's targeting evolves continuously. CISA's joint advisories on PRC-sponsored cyber activity provide updated TTPs and mitigation guidance.
- Review and test your incident response plan for scenarios involving nation-state actors with long-term persistence. Volt Typhoon is not a ransomware group that announces itself — they are pre-positioning for potential future disruption. Your IR plan must account for threats that have been present in your environment for months or years before detection.
Vendor and Government Resources
- CISA Joint Advisory on Volt Typhoon: Review the latest guidance at cisa.gov/news-events/cybersecurity-advisories — search for Volt Typhoon and PRC state-sponsored activity.
- Lumen Black Lotus Labs: Follow their published research at blog.lumen.com for updated Silent Train indicators and relay node intelligence.
- Vendor security advisories: Check each edge device vendor's security advisory portal for firmware updates addressing exploited vulnerabilities. Do not rely on automatic update notifications — many embedded devices do not have this capability.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.