Black Lotus Labs says it has tracked "Silent Train" since November 2023, just before the KV-botnet takedown, and sent hundreds of victim notifications. Instead of a standing botnet, operators build a chain for each session: a VPS outside the US, a second VPS, compromised non-US SOHO and IoT devices, then a US-based exit device before the victim, sometimes six hops in all. Sessions averaged about four hours, chains could be built in under two minutes, and tooling (temporary SSH services, keys, configs) was removed afterwards.

• Devices abused: more than 27 device classes, including TP-Link, Intelbras, Ruckus, Netgear Orbi, Zyxel and Cambium, plus enterprise relays (Fortinet, Cisco, PRTG, Mirth Connect, CyberPanel) that stayed in use for one to three months. Device types kept fixed roles: Intelbras modems only as overseas hops, Netgear Orbi as US hops touching victims.
• Tunnels: chained SSH on non-standard ports, and later reverse tunnels through Chisel and FRP.
• Targets: management planes. Lumen lists a likely zero-day in Quest KACE (more than 30 victims, faded after Quest's October 2025 updates), Versa Director, N-able N-Central (CVE-2025-8875 and CVE-2025-8876), Cisco Catalyst SD-WAN (CVE-2026-20127, still exploited after the February 2026 disclosure) and VeloCloud Orchestrator (CVE-2026-16812). After access it saw in-memory webshells, credential harvesting, abuse of built-in remote features, and erased or altered logs.
• Who and when: telecoms, government, defense contractors, satellite and emergency communications, MSPs, universities with military ties and critical infrastructure, concentrated in Hawaii, California and Texas. Activity ran Monday to Friday, roughly 09:00 to 22:00 China Standard Time, with pauses around Chinese New Year.

Hunting ideas: inbound admin sessions to KACE, N-Central, SD-WAN orchestrators and similar platforms from residential or SOHO IP space; short-lived SSH on unusual ports; Chisel or FRP binaries on edge devices; and gaps or edits in management-platform logs. Keep those logs off the box they describe.