Chinese hackers hid behind hacked home routers to break into key systems

A China-linked hacking group called Volt Typhoon used a hidden network of hijacked routers and other internet-connected devices to break into hundreds of organizations, according to researchers at Lumen Technologies. The network, named Silent Train, has now been disrupted. It was used in four confirmed attacks on flaws that the software makers did not yet know about.

How the hiding worked

Silent Train passed attack traffic through several hacked devices in a row before it reached the target. That made it hard for victims to see where an attack really came from. Researchers say the chains were short-lived. Sessions lasted about four hours on average, and some lasted only minutes. When a session ended, the attackers removed every trace and took the chain apart.

The group relied on 27 types of devices. These included home and small-office gear from TP-Link, NETGEAR, Zyxel, Ruckus Wireless, Cambium, SATO and Intelbras. They also included business products from Fortinet and Cisco, plus PRTG, Mirth Connect and CyberPanel.

Who was hit

Researchers found hundreds of victims. The list covers phone and internet providers, government, defense contractors, satellite and emergency communication services, universities and IT firms. It also covers water, energy, transportation, maritime, rail, aviation and emergency services.

One of the four zero-day attacks used a flaw in Versa Director, tracked as CVE-2024-39717. A zero-day is a flaw that attackers use before the maker has a fix. Volt Typhoon is also suspected of using a likely zero-day in Quest KACE before it was patched in October 2025. That campaign is estimated to have affected more than 30 victims.

How it changed over time

Silent Train began taking shape around November 2023, weeks before the first law enforcement disruption of a separate network of hacked devices called the KV-botnet. Activity rose after that botnet was disrupted a second time in late January 2024. By early 2025, the group kept some business-grade devices for one to three months instead of discarding them after each job.

What to do

Nothing in the report says which specific home devices were used. Still, the lesson is simple. Hacked everyday gear can be quietly borrowed to attack others.

• Install updates on routers and other connected devices.
• Replace devices that no longer get security updates.
• Change default passwords on anything that connects to the internet.

What is not known

The material does not say how the network was disrupted, or how many individual devices were taken over. It also does not name three of the four zero-day flaws.