Lumen’s Black Lotus Labs has spent three years watching a China-linked crew move through infrastructure it never kept. The researchers call the pattern Silent Train and tie it to Volt Typhoon, the group US agencies have chased across critical infrastructure for years.
Nothing in the chain is permanent. A session opens on a rented server abroad, passes through another host, hops across compromised routers and home devices, then exits near the victim from a machine inside the country. Traffic looks local, defeating geographic blocks and reputation filters. Operators average four hops, sometimes six.
Then it disappears. Hardware is scrubbed, keys removed, the chain dismantled. The team recorded new chains assembled in under two minutes, suggesting partial automation. Sessions average about four hours, some only minutes.
More than 27 device classes in the rotation
Black Lotus catalogued over 27 device types, from TP-Link routers and Netgear Orbi units to Fortinet appliances, PRTG sensors and CyberPanel servers. Some classes carry no published vulnerability, pointing to exploits the group never surrendered. Enterprise gear joined the rotation by early 2025, staged overseas first.
Investigations after each notification surfaced at least four confirmed zero-days and one likely candidate. The group also tunneled through the open-source Chisel and FRP proxies, running old and new methods side by side.
Notifying hundreds of victims
Black Lotus has contacted hundreds of victims: telecoms, government bodies, defence contractors, universities, IT firms, plus water, energy, transport, maritime, rail, aviation and emergency services. Activity follows a Monday to Friday schedule in China Standard Time and quietens around Lunar New Year.
Assume routing infrastructure between you and an intruder is suspect. Chain through a device you control, and treat a US-IP egress as no evidence of legitimacy.
