Reputation Radar #18: The Last Hop Was Local

We've spent the last few issues on attackers who borrow trust: a certified phone, a company laptop in a Texas living room, a cloud bucket with a good name. This week's report says the quiet part out loud. Black Lotus Labs, Lumen's research team, explains that Volt Typhoon routes its final hop through home routers in the US for one reason among others: to get past IP reputation systems that flag foreign sources.

That's us they're talking about, more or less. So it's worth reading closely.

A train that never runs the same route twice

Black Lotus Labs has tracked the framework it calls Silent Train for about three years and published the full picture last week. The architecture is fixed, but every piece of it is replaceable.

Sessions start on rented virtual servers outside the US, the report names providers such as UCloud, Alibaba Cloud and Huawei Cloud, then hop through hacked small-office and home devices in other countries: TP-Link routers, Intelbras modems, Zyxel, Ruckus and Cambium gear. The last hop before the victim is a compromised device inside the US, in later operations usually a home Netgear Orbi mesh router.

Each device type has a fixed role. Intelbras modems only ever act as overseas relays, Orbis only ever as the US exit, which keeps the chain tidy and attribution messy. The operators test a new device class abroad before promoting it, and added roughly one new type per quarter.

The speed is what stands out. Building a chain from freshly exploited devices took them under two minutes. Sessions averaged around four hours, and many were done in under ten minutes, after which they removed their tools, keys and configuration and moved on. In the report's words: "Silent Train is built around rapidly rotating chains of compromised SOHO, IoT and enterprise devices that are exploited on demand, used against carefully selected targets, cleaned up after each operation and continuously refreshed."

Aimed at the control plane

What the chain was for matters as much as how it was built. Black Lotus Labs ties it to one likely and four confirmed zero-day campaigns, all against the management systems that run everyone else's systems: Quest KACE, Versa Director, N-able N-central, Cisco Catalyst SD-WAN (CVE-2026-20127, rated 10.0) and VeloCloud Orchestrator (CVE-2026-16812). "Volt Typhoon consistently focused on systems that, once breached, offer extensive visibility, control and access across large enterprise environments."

Targets ran through telecoms, defence contractors, government, satellite providers, utilities, rail, aviation and managed service providers, with the heaviest focus on Hawaii, California and Texas. More recently the framework went hybrid: alongside the throwaway home routers, it kept compromised enterprise systems such as FortiGate appliances as longer-lived hops for one to three months, with up to six hops between the operator and the target.

What the reputation column shows

We'll be blunt about the limits first. The report publishes device types, not addresses, and that's no accident: by the time anyone could share a list, the chain has been torn down and rebuilt somewhere else. A home router that was a relay for eight minutes on Tuesday is an ordinary home router again on Wednesday. No reputation feed, ours included, will reliably catch a residential address in the minutes it spends as somebody's exit node, and we made the same point about phones in Radar #15.

The start of the chain is a different story. When we checked how our API labels the cloud providers named in the report, UCloud's ranges came back as "Commercial VPN", because feeds bulk-tag them as VPN and proxy space. That's the wrong question to hand an analyst: there's no VPN user to identify, just a rented server. We fixed it this week, so UCloud now reads as UCloud, still investigate, with the VPN tags kept underneath. It's the eleventh cloud or hosting provider we've corrected this way since September, and we keep finding them because reports like this one name them.

The more useful signal, though, isn't in any list. It's in your own logs. Black Lotus Labs saw the operators working Monday to Friday, 09:00 to 22:00 China Standard Time. That's roughly 01:00 to 14:00 UTC, or the middle of the night in California. So picture what the final hop looks like from the victim's side: an admin login to your SD-WAN orchestrator or endpoint manager, from a residential address in the US, at 3am Pacific, in a session that ends after a few minutes and never reuses the same address. Every individual piece looks harmless. Together they're a pattern.

The report's own advice lines up with that. Put management interfaces behind VPNs, jump hosts or dedicated networks rather than on the internet. Keep logs from those systems for longer than feels necessary. Hunt for administrative logins and API use outside normal hours. And ask the uncomfortable question about your own management platforms: if someone owned this box, whose networks could they reach from it?

Also on the radar

• Ivanti's chain gets its missing links. Rapid7 covered two more Connect Secure flaws exploited alongside the authentication bypass from Radar #15: CVE-2026-111357, a missing-authentication privilege escalation, and CVE-2026-118527, which allows authenticated file uploads to predictable paths (Rapid7). Patches arrived on October 29th and CISA added both to its catalog the next day. In Rapid7's words, "the combined impact warrants emergency remediation despite the individual CVSS ratings."
• A government Windows build, poisoned through its updates. Kaspersky found an unknown group targeting a customised Windows 10 build used by government bodies in Asia, slipping a trojanised CAB archive into update packages dressed up as Patch My PC components (Securelist). The command server sits behind Cloudflare on a domain styled after OpenAI, openaigpt4v.com. In our API the domain has no history at all and the address resolves to Cloudflare's shared edge, both on investigate: one is too new to have a reputation, the other belongs to everyone.
• VeloCloud again. The orchestrator flaw Volt Typhoon used, CVE-2026-16812, has been in CISA's catalog since July, and a second VeloCloud orchestrator bug made our list just last week. If you run one, it's a good week to check who has logged into it, and from where.

If you want the longer read on why a cloud or residential result in the reputation column is where the question starts rather than where it ends, we walked through it in Borrowed reputation: when attackers hide behind trusted infrastructure.

See you next week.

Sources are linked inline, with credit to Black Lotus Labs at Lumen for the Silent Train research and to the original researchers and vendors. If we got a detail wrong, tell us and we'll fix it.

About Reputation Radar: This is written by the small team building Reput.io, not a marketing department. It's our weekly read on the infosec landscape, with a bias toward the thing we care most about: how attackers borrow the reputation of legitimate infrastructure so their traffic looks normal. Every item links the original reporting, and any claim about our own API is run against it live and labelled.