Volt Typhoon used a disposable relay network called Silent Train to hide zero-day attacks on critical systems, according to Lumen’s Black Lotus Labs. The covert chain began on a rented server outside the United States, passed through up to six compromised devices—including TP-Link routers, Netgear Orbi devices, Fortinet appliances and CyberPanel servers—before reaching a U.S. IP address, making the traffic appear as normal local traffic. Lumen linked Silent Train to at least four confirmed zero-days: Versa Director (2024), N-able N-central (CVE-2025-8875 and CVE-2025-8876), Cisco Catalyst SD-WAN (CVE-2026-20127) and VeloCloud Orchestrator (CVE-2026-16812), plus a likely fifth affecting Quest KACE. Sessions lasted about four hours, could be rebuilt in under two minutes, and were run by human operators Monday-Friday, 9 a.m.-10 p.m. China Standard Time, pausing around Chinese New Year. 1