The relay hiding a state hacking campaign is a fleet of compromised home routers and edge devices, according to Lumen Black Lotus Labs research reported by BleepingComputer and The Hacker News between Oct. 30 and Nov. 2, 2026. Volt Typhoon's network, dubbed Silent Train, chains together 27 or more classes of routers, internet-of-things gear and edge devices.
The chains assemble in under two minutes, which makes the traffic look like ordinary local connections instead of a foreign operation. Researchers link the relay to four confirmed zero-day campaigns, and hundreds of victim notifications have gone out across telecommunications, government and defence.
The weakest box on the network can carry the strongest attacker.
That puts small-office and home routers inside the corporate attack surface. A device deployed for a branch, a remote worker or a client site becomes part of someone else's infrastructure when its firmware is stale or remote administration is left open. Crews handling field deployment and device refresh should inventory edge devices with the same discipline applied to servers: current firmware, unique credentials, and remote admin off unless required.
Audit every router and edge device your organization has placed or relies on, update or replace the ones that cannot be patched, and turn off remote administration you do not use. Your router might already be in the chain.