Volt Typhoon Deploys Stealthy Six-Node Routing Technique
The group’s new method hides malicious activity across multiple virtual networks to bypass standard security monitoring.
Updated on Oct. 29, 2026 in Cybersecurity
Live Poll
Do you trust that U.S. critical infrastructure is sufficiently protected against foreign hacking operations?
Cybersecurity researchers at Black Lotus Labs have identified a sophisticated network access methodology, dubbed Silent Train, used by the China-linked hacking group Volt Typhoon. The technique maintains stealth by routing malicious traffic through complex paths of up to six distinct virtual networks and compromised devices.
Why it matters
By concealing their digital footprint and leveraging previously undiscovered vulnerabilities, Volt Typhoon maintains long-term persistence in sensitive infrastructure sectors. This methodology prioritizes deep, undetected access to support intelligence gathering and potential future disruption of national services.
The Silent Train methodology uses a chain of up to six virtual networks and compromised routers to obscure traffic. The attackers intentionally avoid retracing network paths and actively remove digital traces after operations to prevent attribution.
The players
Volt Typhoon
A state-sponsored hacking group associated with the Chinese government that targets critical national infrastructure.
Black Lotus Labs
A threat intelligence division of the telecommunications firm Lumen that specializes in network monitoring and security research.
The details
Volt Typhoon executes this methodology by chaining compromised devices and virtual networks into a winding, multi-layered pathway. By routing traffic through these six distinct nodes, the group minimizes the risk of exposure. They further harden their access by exploiting previously unknown software vulnerabilities—a category of security flaws called zero-days—and clearing their tracks after operations conclude.
Timeline
October 28, 2026: Identification of the Silent Train network pattern by Black Lotus Labs.
The Tech Race
This methodology represents a significant evolution in evasion tactics compared to traditional single-hop proxy usage. It places Volt Typhoon at the forefront of persistent, multi-layered cyber-espionage efforts targeting national utility and transportation grids.
While this methodology primarily targets government and telecommunications operators, the ripple effects include potential service interruptions in the water, rail, and aviation sectors. Organizations in these critical industries are advised to increase vigilance regarding unusual traffic patterns across multiple network hops.
The takeaway
The Silent Train technique underscores a shift toward highly complex, obfuscated persistence in critical infrastructure. Security teams should monitor for traffic chains exceeding standard proxy configurations as a potential indicator of unauthorized access.
Further reading
For more on the evolving tactics of state-sponsored groups, explore our full Cybersecurity section.
Live Poll
Do you trust that U.S. critical infrastructure is sufficiently protected against foreign hacking operations?
