# Volt Typhoon's Silent Train Network Hid Four Zero-Day Campaigns

- URL: https://usa-24.com/volt-typhoon-silent-train-zero-day/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-30T00:49:07.843Z
- Updated: 2026-10-30T00:49:07.850Z
- Topics: Volt Typhoon, Zero-Day Exploits, Cisco, Critical Infrastructure, Nation-State Hacking

> Lumen says China-linked Volt Typhoon used a rotating relay network called Silent Train to hide four confirmed zero-day campaigns against enterprise management platforms.

## Key takeaways

- Lumen's Black Lotus Labs says Volt Typhoon used the Silent Train relay network to hide four confirmed zero-day campaigns, published October 28, 2026.
- The campaigns target Versa Director, N-able N-central, Cisco Catalyst SD-WAN and Arista VeloCloud Orchestrator, and one VeloCloud flaw, CVE-2026-16812, is rated CVSS 10.0.
- Lumen says the mapped activity ran from November 2023 through July 2026, with Hawaii, California and Texas as the most-targeted US regions.
- A separate Quest KACE campaign affecting more than 30 victims is assessed as a likely zero-day with moderate confidence, so it is not counted among the four confirmed campaigns.
- Reports disagree on how many US networks were breached, so the exact US victim count remains unconfirmed until Lumen's full breakdown is read.

## What the Volt Typhoon Silent Train network does

The China-linked hacking group Volt Typhoon used a rotating relay network called Silent Train to hide four confirmed zero-day campaigns, according to [research Lumen's Black Lotus Labs published on October 28](https://www.lumen.com/blog/en-us/silent-train-volt-typhoon-operational-framework). The Volt Typhoon Silent Train campaigns did not target office laptops or public websites. They targeted the management and control platforms that give an administrator reach across an entire organization.

Lumen describes Silent Train as a constantly changing chain of compromised routers, IoT devices and enterprise servers. Operators use that chain to conceal where their activity starts, so a defender who finds one intrusion may see only the last hop. [Cybersecurity News](https://cybersecuritynews.com/chinese-hackers/) and the [OpenVPN blog](https://blog.openvpn.net/brotli-flaw-silent-train-artex-ai-unm-health-attack) described the network in similar terms.

Lumen says the group kept Silent Train for the exploitation, credential access and exfiltration phases, separate from the reconnaissance infrastructure it used earlier. That split changes how defenders should think about blocking. Shutting down scanning infrastructure does not automatically cut off the relays an intruder uses once inside.

## The four confirmed zero-day campaigns and five CVEs

Lumen ties Silent Train to four confirmed zero-day campaigns against Versa Director, N-able N-central, Cisco Catalyst SD-WAN and Arista VeloCloud Orchestrator. [SecurityWeek](https://www.securityweek.com/cisco-sd-wan-zero-day-exploitation-tied-to-volt-typhoons-silent-train-network/) and [The Hacker News](https://thehackernews.com/2026/10/volt-typhoon-used-covert-silent-train.html) both report the link. Five CVEs are involved in total.

| Product | CVE | What the sources say |
|---|---|---|
| Versa Director | CVE-2024-39717 | Volt Typhoon previously used a Versa Director zero-day to deliver a web shell called VersaMem |
| N-able N-central | CVE-2025-8875, CVE-2025-8876 | Two flaws in the N-central platform |
| Cisco Catalyst SD-WAN | CVE-2026-20127 | Lumen says exploitation continued long after Cisco disclosed it |
| Arista VeloCloud Orchestrator | CVE-2026-16812 | Rated CVSS 10.0, the highest score on the scale |

CVE-2026-16812 will draw the most attention. [Decryption Digest](https://www.decryptiondigest.com/blog/volt-typhoon-silent-train-zero-day-critical-infrastructure) reports its CVSS score is 10.0 and says a patch has been available since July 2026. That date lines up with the end of the activity window Lumen mapped, which ran from November 2023 through July 2026.

Lumen also tracks a separate Quest KACE campaign that affected more than 30 victims. Its zero-day status is assessed as likely, with moderate confidence, so it is not counted among the four confirmed campaigns.

## Which US regions and sectors were hit

Lumen says Hawaii, California and Texas were the most-targeted US regions. Victims span telecoms, government bodies, defense contractors, satellite and communications providers, universities with military ties, managed service providers and critical infrastructure operators.

The total count is where reporting diverges. [TechTimes](https://www.techtimes.com/articles/329655/20261029/chinas-volt-typhoon-breached-hundreds-us-networks-via-self-erasing-relay-chains.htm) describes the campaign as breaching "hundreds of US networks." Other write-ups built on Lumen's work describe hundreds of victims identified across sectors and countries. Those are different claims, and the US figure should not be treated as confirmed until the report's breakdown is read directly.

In the Black Lotus Labs research, as relayed by SecurityWeek, Lumen put the pattern this way: "Every zero-day campaign through Silent Train targeted this kind of platform." The quote is attributed to Lumen as an organization. No individual researcher was named in the coverage we reviewed.

## Why management platforms are an attractive target

Management and control-plane software sits above ordinary servers. An attacker who controls an SD-WAN console or a monitoring server can reach many downstream networks at once, often using trusted administrative access. That is why Lumen's focus on these products matters more than the raw victim count.

The history adds context. [Tokenpost's summary of the Lumen research](https://www.tokenpost.com/news/technology/43131) notes that CISA's February 2024 advisory said US agencies assessed Volt Typhoon was positioning itself in US infrastructure for disruptive or destructive activity during a future crisis or conflict. That assessment was broader than Silent Train and was not tied to these campaigns. Silent Train adds something the 2024 warning did not have: a documented method for the access work that precedes any such disruption. The group has been active since at least 2021, according to The Hacker News.

Cisco's SD-WAN flaw is a useful test case. [Forbes reported](https://www.forbes.com/sites/daveywinder/2026/02/28/emergency-cisco-0day-security-warning-immediate-action-required/) that the bug drew an emergency directive from CISA in February 2026. Lumen's finding that Volt Typhoon kept using it afterward suggests that some operators had either not finished remediation or had not checked whether the flaw was still being exploited.

The pattern is familiar from other edge-device incidents. USA 24 has reported how [k0t took 70,000 credentials from VPN and firewall devices](https://usa-24.com/k0t-fortigate-credentials-theft/), and how [ransomware gangs exploited a Palo Alto GlobalProtect flaw that had been patched in May](https://usa-24.com/palo-alto-globalprotect-vulnerability-ransomware/). The Palo Alto case turned on an unpatched system, while the k0t case showed how much damage stolen device credentials can do. Operators of telecom, utility and government networks carry most of the risk here. Vendors also face pressure, because the attack chain depends on their products sitting in the most trusted part of the network.

## What IT teams should do now

These steps follow standard vendor guidance and the sources reviewed. Confirm each one against the vendor's own advisory before acting, because the write-ups we reviewed are secondary sources.

- Inventory the four platforms. Identify every instance of Versa Director, N-able N-central, Cisco Catalyst SD-WAN and VeloCloud Orchestrator, including test and branch deployments, and record each version.
- Confirm the patches. Check that fixes for CVE-2026-16812, CVE-2026-20127, CVE-2025-8875, CVE-2025-8876 and CVE-2024-39717 are applied. Do not assume an older patch covers the build you run now.
- Review management logs back to November 2023. Look for admin logins at unusual hours, new accounts, configuration changes and unexplained outbound connections from management hosts. That start date matches the window Lumen mapped.
- Check Lumen's indicators. Block the command-and-control addresses that Lumen or other vendors publish, and search historical traffic logs for them.
- Shrink the exposure. Remove direct internet access to management and SD-WAN consoles where possible, require strong multifactor authentication, and restrict access to allowlisted addresses. If logs show suspicious access, rotate the credentials those consoles hold.

## What to watch next

Several questions remain open. Our sources did not confirm whether CISA or the FBI has issued a new advisory or added the Silent Train CVEs to the Known Exploited Vulnerabilities catalog. We also could not verify whether vendors have published new advisories for CVE-2026-16812 or the N-central flaws. No US government response specific to Silent Train turned up in the results we reviewed.

The next useful signals are Lumen's full report, with its victim breakdown and indicator list, and any catalog addition, which would set a federal patch deadline. If the Quest KACE activity is confirmed as a zero-day, the campaign count will grow, and so will the list of management products defenders need to inventory this week.

## Frequently asked questions

### What is Volt Typhoon's Silent Train network?

Silent Train is a constantly changing chain of compromised routers, IoT devices and enterprise servers that operators use to hide where their activity begins, according to Lumen's Black Lotus Labs research published October 28, 2026. Lumen says the group used it for exploitation, credential access and data exfiltration, separate from its reconnaissance infrastructure. Lumen links the network to four confirmed zero-day campaigns.

### Which products are affected by the Silent Train campaigns?

Lumen links the campaigns to Versa Director, N-able N-central, Cisco Catalyst SD-WAN and Arista VeloCloud Orchestrator. The five CVEs are CVE-2024-39717, CVE-2025-8875, CVE-2025-8876, CVE-2026-20127 and CVE-2026-16812. CVE-2026-16812 is rated CVSS 10.0, and one analysis says its patch has been available since July 2026.

### Which US regions were most targeted by Volt Typhoon in this campaign?

Lumen says Hawaii, California and Texas were the most-targeted US regions. Victims include telecoms, government bodies, defense contractors, satellite and communications providers, and critical infrastructure operators. The total number of US victims differs across reports, so readers should wait for Lumen's full breakdown.

### What should IT teams do first about Silent Train?

Start by inventorying whether you run any of the four platforms and recording their versions. Then confirm the vendor fixes are applied and review admin logs on management systems back to November 2023. Restrict internet exposure of management and SD-WAN consoles and require strong authentication.

## Sources

1. [Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns](https://thehackernews.com/2026/10/volt-typhoon-used-covert-silent-train.html)
2. [Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon's 'Silent Train' Network](https://www.securityweek.com/cisco-sd-wan-zero-day-exploitation-tied-to-volt-typhoons-silent-train-network/)
3. [Silent Train: uncovering Volt Typhoon's operational framework for zero-day exploitation and strategic access](https://www.lumen.com/blog/en-us/silent-train-volt-typhoon-operational-framework)
4. [Lumen Links Volt Typhoon to Four Silent Train Zero-Day Campaigns](https://www.tokenpost.com/news/technology/43131)
5. [Volt Typhoon Silent Train: 4 US Zero-Day Campaigns](https://www.decryptiondigest.com/blog/volt-typhoon-silent-train-zero-day-critical-infrastructure)
6. [China's Volt Typhoon Breached Hundreds of US Networks via Self-Erasing Relay Chains](https://www.techtimes.com/articles/329655/20261029/chinas-volt-typhoon-breached-hundreds-us-networks-via-self-erasing-relay-chains.htm)
7. [Chinese Hackers Use Secret Silent Train Network to Exploit Zero-Days Against U.S. Government and Defense](https://cybersecuritynews.com/chinese-hackers/)
8. [This Week in Cybersecurity: A Critical Brotli Flaw, Volt Typhoon's Silent Train, and an AI Pentest Tool Turned Attack Kit](https://blog.openvpn.net/brotli-flaw-silent-train-artex-ai-unm-health-attack)
9. [Emergency Cisco Critical 0Day Update—Attackers Downgrade Security](https://www.forbes.com/sites/daveywinder/2026/02/28/emergency-cisco-0day-security-warning-immediate-action-required/)