Chinese hackers use hijacked home routers to hide their attacks

A Chinese state-backed hacking group called Volt Typhoon has been hiding its attacks behind hijacked routers and modems, according to researchers. They call the setup Silent Train. The group also used at least four zero-days, which are security flaws the maker did not know about, so no fix existed when the attacks began.

How Silent Train works

Think of a relay race. The attackers send their activity through rented servers outside the United States. Then it passes through hacked devices, such as routers, that hand it along before the attack starts. This hides where the attack really comes from. Black Lotus Labs, the research arm of communications company Lumen, says Intelbras modems served as overseas relays and Netgear Orbi devices acted as hops in the U.S.

The attackers get in through web admin pages left open to the internet on small office, home and other connected devices. They install only the tools they need. When the session ends, usually in under 8 hours, they wipe their tools, keys and settings files from the device. That makes the relays disposable and hard to trace.

Who is targeted

The group goes after telecom firms, government agencies, defense contractors, schools, utilities, satellite providers, IT firms, transportation, aviation and emergency services. California, Texas and Hawaii were the most targeted places, which suggests a focus on Indo-Pacific matters. The U.S. cyber agency CISA has warned that Volt Typhoon seeks access that could be used to cause disruption in a future crisis or conflict.

Researchers have tracked Silent Train for three years. They believe it is saved for high-value targets and careful, hands-on work during China Standard Time hours. By early 2025 it had become a mix: disposable relays plus hacked business systems kept for one to three months. The FBI's takedown of an earlier network, KV-Botnet, helped push the group toward this approach.

What to do

Most readers are not the target. But a router or modem in a home or small office can still be borrowed as a stepping stone, and the owner may never notice. These steps help:

• Install router and modem updates, and replace devices that no longer get them.
• Change default passwords on every router and modem.
• Keep the device's admin page off the internet.
• Businesses: watch for unusual admin activity and keep logs longer.

What is not known

The products hit by the four zero-days are not named here, so the full Black Lotus Labs report is the place to check. Researchers also advise following CISA and NCSC guidance on Volt Typhoon.