Black Lotus Labs identifies a hidden network pattern used by Volt Typhoon

The route crossed up to six virtual networks and used compromised routers

An NPR report published Oct. 28, 2026, describes a repeatable network pattern that researchers at Lumen’s Black Lotus Labs call Silent Train. The team linked the pattern to Volt Typhoon, a Chinese government hacking group, and said the route could pass through up to six virtual networks while using compromised devices such as routers to reach an intended destination. U.S. national security officials say Volt Typhoon focuses on secretly gaining access to key strategic targets.

Michael Horka, a principal information security analyst at Black Lotus Labs, has watched network traffic flowing along the backbone of the internet for years. He said the lab identifies, tracks and disrupts nation-state and criminal threat actors as they traverse the internet. Lumen is a major telecommunications company that helps route network traffic, while hackers can cover some tracks but cannot fully hide all their digital footprints.

Horka said Volt Typhoon has concentrated on government and defense, telecommunications and broader communications, and critical infrastructure, including water, rail and aviation. The focus on those targets has remained for years, the report said, but Horka said the group had become much sneakier by using novel tactics to stay hidden.

McLaughlin said the selected targets can support intelligence gathering. Adversaries with access could also cause physical damage, she said, by shutting off power or cutting access to ports and potentially creating societal panic or preventing the U.S. military from responding quickly during a conflict.

The Black Lotus team reached Silent Train after extended detective work. Horka described the process: “It was a lot of thread pulling, but as we pulled on those threads, we eventually made it back to somewhat of a reproducible pattern - a reproducible network pattern that we were able to signature.” He added: “It definitely felt like a wild goose chase a lot of times.”

McLaughlin said the hackers would create a new winding pathway through up to six virtual networks and compromised devices such as routers to reach their ultimate destination, never retracing their steps. Volt Typhoon also used previously undiscovered vulnerabilities and covered its tracks behind it, according to the report. “They were purposely trying to stay extremely quiet,” Horka said.

Horka said the hackers were highly motivated and willing to invest in their operations, and defenders needed to make similar investments. He urged network defenders and threat hunters to approach valuable systems as attackers might: “It’s important for network defenders and threat hunters to put on that black hat for a moment and just think, like, hey, if this is really valuable to us as an organization, it would probably be a target as well.”

Exposing Volt Typhoon’s tradecraft might at least make it harder for the group to hide, Horka said. He compared the exposure to dropping a rock into still pond water and said he would watch what followed: “If I had to use an analogy, if the pond water has just been sitting for so long and nothing’s happening, and there’s nothing you can do, like, we’re dropping a rock in it, and we’re going to see what happens.”