Lumen's Black Lotus Labs reports that China-linked Volt Typhoon built a second network, 'Silent Train', while the FBI was dismantling the KV Botnet (December 2023–January 2024), supporting a roughly three-year campaign against US government, telecommunications, defence contractors, satellite services, universities and critical infrastructure (Nextgov, 28 October). It comprised more than 27 device classes, some with no known vulnerabilities; access windows averaged about four hours and traces were removed. The concentration in Hawaii, California and Texas is assessed as pre-positioning for an Indo-Pacific contingency.
From developments to evidence and analysis
Background
No explicit relationship is recorded.
Evidence
No explicit relationship is recorded.
Follow-ups / later versions
No explicit relationship is recorded.
Related questions
Cite this article
AI & Security Observatory（2026-10-28）「Lumen、中国系Volt Typhoonの第2ネットワーク「Silent Train」を報告 米防衛・インフラに3年間潜伏」『AI & Security Observatory』、第1.0版、最終更新2026-10-29。https://ai-security-observatory.org/ja/brief/brief-20261029-18/
AI & Security Observatory (2026-10-28). Lumen reports China-linked Volt Typhoon built a second network, 'Silent Train', inside US defence and infrastructure targets for three years . AI & Security Observatory, version 1.0. Updated 2026-10-29. https://ai-security-observatory.org/en/brief/brief-20261029-18/
Version 1.0 · Publication date 28 Oct 2026 · Updated 29 Oct 2026
Revision history
- Earlier revisions have not been recorded.