The FBI Seized Volt Typhoon's Botnet. The Replacement Rebuilds Itself in Under Two Minutes.

In December 2023, the FBI and the Justice Department disrupted a botnet called KV: thousands of hijacked routers, mainly Cisco and Netgear models, that Chinese state-sponsored operators used as a curtain between themselves and the American networks they were mapping. The operation was announced the following month. CISA's advisory on the group arrived in February, and the whole episode was reported, fairly, as a significant blow.

Black Lotus Labs first observed the thing that replaced it in November 2023, a few weeks before the takedown. Lumen's threat research arm spent the next three years watching it and published its account on Wednesday.

The report calls the framework Silent Train. Its findings are the kind that get filed under nation-state threat intelligence and then skipped by everyone who is not a SOC analyst: hundreds of victim notifications across telecoms, defence contractors, utilities, universities with military ties and managed service providers; at least four confirmed zero-day campaigns and a fifth rated likely; victims concentrated in Hawaii, California and Texas.

The number worth carrying out of it is smaller than any of those. Operators could assemble a fresh chain of compromised devices, on different infrastructure, in under two minutes.

"Individual chains are assembled and dismantled every day, with infrastructure continually refreshed," Michael Horka, the Black Lotus Labs engineer who led the research, told CyberScoop. "Volt Typhoon demonstrated a repeatable capability to rebuild a new chain with different infrastructure in less than two minutes, making the number of nodes at any one moment effectively close to zero."

A network with no nodes at any one moment

Silent Train is a layered, multi-hop framework: two virtual private servers outside the United States, then compromised small-office and IoT devices in other countries, then a compromised device inside the United States so traffic arrives from a domestic address and clears geo-blocking and reputation filters. Four hops on average before US IP space, another before the victim, up to six by 2025.

The architecture itself is unremarkable. Plenty of actors chain proxies. What Lumen documents is the discipline around it. Chains were built semi-automatically: exploit an exposed web interface, drop in a temporary SSH service with keys and configuration, use it, then strip every artefact and dismantle the chain. Sessions averaged about four hours. Some lasted minutes. Each was pointed at one to five victims, often a single organisation.

Device types were assigned to fixed roles and never swapped, for three years. Intelbras modems only ever appear as overseas relays. Netgear Orbi units only ever appear as the US hop that touches the victim. The group had enough global infrastructure to rotate those roles and chose not to.

"The diversity matters, but the discipline matters even more," Horka said. "Specific device types were consistently reserved for particular positions in the chain. It operated less like a collection of randomly compromised devices and more like an organized inventory of capabilities."

More than 27 device classes were used, from TP-Link and Zyxel routers to Fortinet appliances, PRTG monitoring servers, Mirth Connect integration engines and CyberPanel hosting panels. A few of those classes had no known vulnerability at the time, which Lumen reads as zero-days spent simply to hold one relay open.

The timing looks like shift work: Monday to Friday, 09:00 to 22:00 China Standard Time, with multiweek pauses around Chinese New Year. By early 2025 the framework had turned hybrid. Compromised enterprise platforms were kept for one to three months as stable final hops, alongside the disposable consumer gear, and some hops were replaced by reverse tunnels through the open-source proxies Chisel and FRP.

Five campaigns, and every target sat in the control plane

The zero-days can be checked against public records, and they line up.

Quest KACE, the endpoint management suite, is the softest claim. Lumen assesses with moderate confidence that an undisclosed flaw was used against more than 30 victims, with activity falling away after Quest's October 2025 patches. Versa Director came next, exploited as a zero-day in mid-2024 and tracked as CVE-2024-39717, followed by an in-memory JAR webshell. Then N-able N-central, through CVE-2025-8875 and CVE-2025-8876, both rated 9.4 under CVSS 4.0 and added to CISA's Known Exploited Vulnerabilities catalogue on 13 August 2025.

Then the two that matter most. Cisco Catalyst SD-WAN, through CVE-2026-20127, an authentication bypass in the peering mechanism rated 10.0, published on 25 February 2026 and given federal civilian agencies two days to patch. Lumen says exploitation continued well after Cisco disclosed it. VeloCloud Orchestrator, the third SD-WAN platform in the sequence, followed through CVE-2026-16812, an unauthenticated OS command injection rated 10.0 under both CVSS versions, published on 27 July 2026 and added to the KEV catalogue the same day with a deadline of 30 July.

Every one is a management platform. Not a laptop, not a mail server, not a database. The systems that hold the inventory, the credentials and the remote administration for everything downstream.

"Threat actors typically need to traverse networks, identify administrators, locate key systems, and establish multiple footholds to gain visibility," the report says. "Volt Typhoon bypasses this by targeting management platforms directly, which already have visibility, access, and administrative functions."

There is no lateral movement to catch, because there is no need to move. The console already reaches thousands of endpoints, and in a telco or an MSP it reaches customers too. Post-incident work also found in-memory webshells, credential harvesting and abuse of native features, and in several cases logs had been altered or erased. The platform that gives an administrator reach gives an intruder the same reach, minus the audit trail that would have recorded it.

The orchestrator bug we covered in October

Six days ago this blog looked at VeloCloud Orchestrator from the other end. Arista had disclosed CVE-2026-114625, a 9.9 SQL injection that turned the lowest tenant role into superuser, the third exploited zero-day in that product since late July. The piece noted in passing that CISA had added CVE-2026-16812 to its catalogue on 27 July with a three-day deadline, then moved on.

Lumen has now put a name to that July bug. CVE-2026-16812 was Volt Typhoon's zero-day, used through Silent Train before Arista published, and it is the first of the three. The October flaw is a separate CVE on a separate release train. The report does not attribute it, and nothing here should be read as saying this group was behind it.

What has changed is the context around the series. A 10.0 unauthenticated command injection in an SD-WAN orchestrator, spent as a zero-day, is an expensive thing to use. Using it says something about what the access was worth. The Cisco campaign says the same thing more bluntly: a 10.0 authentication bypass in the SD-WAN control plane, still being exploited after disclosure, because the access it bought was worth more than the noise of burning it.

Two control-plane 10.0s in five months, both aimed at the layer that administers the network rather than the network itself. For anyone running these platforms the immediate answer is unchanged: patch, get the admin interface off the open internet, and know who holds a login. What changes is the reason to expect more. Three exploited VeloCloud zero-days in three months is not a run of bad luck at one vendor. It is a target class.

What the report does not settle

Three things are worth stating plainly, because some of the coverage has been more confident than the document.

Lumen says it "quietly disrupted" Silent Train, and does not say how. The same report describes a framework rebuilt on demand and continuously refreshed, and Horka's own framing is that it is "fundamentally difficult to disrupt because there isn't one network to take down." The targeting map runs from November 2023 to July 2026, so the observed window closes three months before publication. CyberScoop describes the activity as ongoing. The report does not put a date on the present.

There are also no indicators in it. No IP list, no hashes, no domains. That is the finding rather than an omission: the infrastructure is dismantled at the end of each session, so a blocklist would be stale before it shipped. The corollary is that the document is only actionable for organisations that kept logs long enough to go looking, which is a smaller group than the one that will read the headline.

And the victimology is Lumen's own. "The ephemeral nature of the framework means our observations should not be interpreted as a complete census of Volt Typhoon activity," Horka told CyberScoop. Nextgov added something the report does not say: two anonymous sources describing Department of Energy facilities and multiple utilities as affected over the past year. That is reported and unconfirmed. The report is also a commercial vendor's account, from a telecom with backbone visibility and a security product to sell. That does not make it wrong. It does mean the numbers you can verify are the CVEs, and the numbers you cannot verify are the victim counts.

One inconsistency, for the record: the text puts average sessions at about four hours, while a figure caption says most lasted around eight to ten. Neither changes the argument.

The relays are somebody's product

The part of this story that reaches past national security reporting is where the relays come from. In April, CISA, the UK's NCSC and more than a dozen partner agencies published a joint advisory on what they call China-nexus covert networks. The detail that stands out is the hardware. The KV botnet, the one disrupted in 2023, was built mainly from Cisco and Netgear routers that were end of life: out of date, no longer receiving updates from their manufacturers, and still answering on the internet.

That is the supply chain behind every one of these frameworks. A device shipped with a web administration interface, a five-year support window and no update path becomes, somewhere around year six, an anonymous hop for somebody else's intrusion. Multiply by consumer routers, IoT cameras, NAS boxes and small-business firewalls and you get the raw material: not a vulnerability in the abstract, but installed hardware whose owner has no reason to think about it.

The April advisory is blunt about the consequence. Static blocklists stop working when an actor can come from any of hundreds of thousands of endpoints and one network may serve several of them. Its advice is therefore unglamorous: map the edge, baseline what should be connecting to your VPN, ask whether consumer broadband ranges have any business reaching corporate services, use allowlists rather than deny lists, and keep the logs.

For a hardware company, the same facts are a design and lifecycle question. Whether an administrative interface is reachable from the open internet is settled at specification, not at deployment. So is whether the device can be updated in the field five years later, by whom, and for how long. The 27 device classes in this report are 27 products that somebody chose to ship that way.

If you are building connected hardware, or buying a fleet of it, that is the part of this story you can act on. At DMC we work with hardware and product companies on exactly that boundary: management-plane architecture, firmware and update paths, and the sourcing and lifecycle commitments that decide whether a device can be fixed in year six or quietly becomes someone else's relay. If that map is still open on your side, let's talk.