# Chinese Hackers Exploit Zero-Days via Covert Network Against U.S. Targets

*Published October 30, 2026*
*Source: [https://cybersecuritynews.com/chinese-hackers/](https://cybersecuritynews.com/chinese-hackers/)*

## Executive Summary

*This is a Premium edition. The Executive Summary is available to sec-news.ai members —*
*[read it here](https://www.sec-news.ai/news/chinese-hackers-exploit-zero-days-via-covert-network-against-u-s-targets) or [see plans](https://www.sec-news.ai/pricing).*

## Article

A sophisticated hacking group known as Volt Typhoon, linked to China, has been leveraging a clandestine network named Silent Train to carry out zero-day attacks on U.S. government entities, defense contractors, and critical infrastructure. This network ingeniously combines compromised routers, connected devices, and enterprise servers to obscure the origins of cyber activities, enabling attackers to infiltrate sensitive systems undetected. The extensive investigation, led by researchers from Lumen's Black Lotus Labs, has traced years of targeted cyber intrusions back to Silent Train, linking it to attacks on centralized management platforms.

These management systems, which possess trusted access to expansive networks, have been exploited by attackers to pilfer credentials and gain unfettered access to client environments. Since its first appearance in November 2023, Silent Train has expanded beyond disrupted infrastructure, such as the previously reported KV-botnet, to a more disposable and meticulously controlled operating model. The hackers initiate their operations from virtual private servers located outside the United States, routing through compromised overseas devices before penetrating U.S. infrastructure, a tactic that helps them avoid detection by making their traffic appear domestic.

Lumen's research has uncovered the use of over 27 different device classes in this intricate network. Operators exploit exposed web interfaces, installing temporary SSH services and configuration files, with sessions lasting about four hours. By the start of 2025, they had begun to establish longer-lived connections within enterprise systems, some persisting for months. The activity predominantly aligns with a human work schedule, occurring mostly on weekdays during business hours in China.

The targets of these operations underscore the strategic value of this hidden network. Attackers have focused on endpoint managers and software-defined wide-area network controllers, exploiting vulnerabilities in platforms such as N-central, Versa Director, Cisco Catalyst SD-WAN, and VeloCloud Orchestrator. These campaigns have aimed to harvest credentials, exploit remote administration features, and sometimes modify or delete logs, with particular focus on regions like Hawaii, California, and Texas. Lumen emphasizes the importance of securing internet-facing management interfaces, applying vendor patches promptly, and scrutinizing downstream trust relationships to mitigate the risk posed by such advanced threats.