Volt Typhoon's Silent Train Network Hid Four Zero-Day Campaigns

What the Volt Typhoon Silent Train network does

The China-linked hacking group Volt Typhoon used a rotating relay network called Silent Train to hide four confirmed zero-day campaigns, according to research Lumen's Black Lotus Labs published on October 28. The Volt Typhoon Silent Train campaigns did not target office laptops or public websites. They targeted the management and control platforms that give an administrator reach across an entire organization.

Lumen describes Silent Train as a constantly changing chain of compromised routers, IoT devices and enterprise servers. Operators use that chain to conceal where their activity starts, so a defender who finds one intrusion may see only the last hop. Cybersecurity News and the OpenVPN blog described the network in similar terms.

Lumen says the group kept Silent Train for the exploitation, credential access and exfiltration phases, separate from the reconnaissance infrastructure it used earlier. That split changes how defenders should think about blocking. Shutting down scanning infrastructure does not automatically cut off the relays an intruder uses once inside.

The four confirmed zero-day campaigns and five CVEs

Lumen ties Silent Train to four confirmed zero-day campaigns against Versa Director, N-able N-central, Cisco Catalyst SD-WAN and Arista VeloCloud Orchestrator. SecurityWeek and The Hacker News both report the link. Five CVEs are involved in total.

CVE-2026-16812 will draw the most attention. Decryption Digest reports its CVSS score is 10.0 and says a patch has been available since July 2026. That date lines up with the end of the activity window Lumen mapped, which ran from November 2023 through July 2026.

Lumen also tracks a separate Quest KACE campaign that affected more than 30 victims. Its zero-day status is assessed as likely, with moderate confidence, so it is not counted among the four confirmed campaigns.

Which US regions and sectors were hit

Lumen says Hawaii, California and Texas were the most-targeted US regions. Victims span telecoms, government bodies, defense contractors, satellite and communications providers, universities with military ties, managed service providers and critical infrastructure operators.

The total count is where reporting diverges. TechTimes describes the campaign as breaching "hundreds of US networks." Other write-ups built on Lumen's work describe hundreds of victims identified across sectors and countries. Those are different claims, and the US figure should not be treated as confirmed until the report's breakdown is read directly.

In the Black Lotus Labs research, as relayed by SecurityWeek, Lumen put the pattern this way: "Every zero-day campaign through Silent Train targeted this kind of platform." The quote is attributed to Lumen as an organization. No individual researcher was named in the coverage we reviewed.

Why management platforms are an attractive target

Management and control-plane software sits above ordinary servers. An attacker who controls an SD-WAN console or a monitoring server can reach many downstream networks at once, often using trusted administrative access. That is why Lumen's focus on these products matters more than the raw victim count.

The history adds context. Tokenpost's summary of the Lumen research notes that CISA's February 2024 advisory said US agencies assessed Volt Typhoon was positioning itself in US infrastructure for disruptive or destructive activity during a future crisis or conflict. That assessment was broader than Silent Train and was not tied to these campaigns. Silent Train adds something the 2024 warning did not have: a documented method for the access work that precedes any such disruption. The group has been active since at least 2021, according to The Hacker News.

Cisco's SD-WAN flaw is a useful test case. Forbes reported that the bug drew an emergency directive from CISA in February 2026. Lumen's finding that Volt Typhoon kept using it afterward suggests that some operators had either not finished remediation or had not checked whether the flaw was still being exploited.

The pattern is familiar from other edge-device incidents. USA 24 has reported how k0t took 70,000 credentials from VPN and firewall devices, and how ransomware gangs exploited a Palo Alto GlobalProtect flaw that had been patched in May. The Palo Alto case turned on an unpatched system, while the k0t case showed how much damage stolen device credentials can do. Operators of telecom, utility and government networks carry most of the risk here. Vendors also face pressure, because the attack chain depends on their products sitting in the most trusted part of the network.

What IT teams should do now

These steps follow standard vendor guidance and the sources reviewed. Confirm each one against the vendor's own advisory before acting, because the write-ups we reviewed are secondary sources.

• Inventory the four platforms. Identify every instance of Versa Director, N-able N-central, Cisco Catalyst SD-WAN and VeloCloud Orchestrator, including test and branch deployments, and record each version.
• Confirm the patches. Check that fixes for CVE-2026-16812, CVE-2026-20127, CVE-2025-8875, CVE-2025-8876 and CVE-2024-39717 are applied. Do not assume an older patch covers the build you run now.
• Review management logs back to November 2023. Look for admin logins at unusual hours, new accounts, configuration changes and unexplained outbound connections from management hosts. That start date matches the window Lumen mapped.
• Check Lumen's indicators. Block the command-and-control addresses that Lumen or other vendors publish, and search historical traffic logs for them.
• Shrink the exposure. Remove direct internet access to management and SD-WAN consoles where possible, require strong multifactor authentication, and restrict access to allowlisted addresses. If logs show suspicious access, rotate the credentials those consoles hold.

What to watch next

Several questions remain open. Our sources did not confirm whether CISA or the FBI has issued a new advisory or added the Silent Train CVEs to the Known Exploited Vulnerabilities catalog. We also could not verify whether vendors have published new advisories for CVE-2026-16812 or the N-central flaws. No US government response specific to Silent Train turned up in the results we reviewed.

The next useful signals are Lumen's full report, with its victim breakdown and indicator list, and any catalog addition, which would set a federal patch deadline. If the Quest KACE activity is confirmed as a zero-day, the campaign count will grow, and so will the list of management products defenders need to inventory this week.