Lumen says Volt Typhoon banks Silent Train access in infrastructure
Lumen says the group rotates exploited SOHO, IoT and enterprise devices, including multiple zero-days, against high-value targets.
78
Organization
Black Lotus Labs
- Mentions · 7d10
- Mentions · 30d18
- All mentions23
- First seenAug 26, 2026
- Last mentioned1d ago
Timeline
23 articles · newest firstVolt Typhoon used rotating Silent Train relays for zero-days
Lumen says exploited products included Versa, N-able, Cisco SD-WAN, VeloCloud and possibly Quest KACE; KeyDrift hit Cisco controllers.
86
Volt Typhoon used Silent Train for US zero-day intrusions
Lumen says four confirmed zero-day campaigns hit management platforms, with credential theft and chains of compromised devices.
84
Volt Typhoon used Silent Train relays to hide zero-day attacks
Lumen links the relay network to four confirmed zero-days and one likely flaw, with sessions rebuilt in under two minutes.
84
Volt Typhoon-linked actor exploited Cisco SD-WAN zero-day to steal encryption keys
CVE-2026-20127 (CVSS 10) gives unauthenticated admin access to SD-WAN controllers; KeyDrift malware siphoned keying material and Volt Typhoon kept exploiting the flaw after disclosure.
92
Volt Typhoon Exploits Zero-Days to Breach Critical Infrastructure
Volt Typhoon built Silent Train framework using zero-days in Quest KACE, N-central, Cisco SD-WAN and VeloCloud to access U.S. critical infrastructure.
80
Cisco SD-WAN CVE-2026-20127 exploited to install KeyDrift key-stealing malware
The malware hooks vdaemon to copy AES-256 key material; Cisco calls exploitation limited and lists fixed trains.
84
Volt Typhoon used Silent Train in four zero-day campaigns
Black Lotus Labs says the rotating SOHO and IoT relay network hit hundreds of victims, including US critical infrastructure.
84
Volt Typhoon rebuilt Silent Train relay chains since late 2023
Black Lotus Labs says chains were rebuilt in under two minutes and hundreds of victims were notified.
84
Volt Typhoon uses Silent Train relays for zero-day edge attacks
Black Lotus Labs says four confirmed zero-days hit VeloCloud, Cisco SD-WAN, N-central, and Versa Director.
86
In Other News: AI Used in Korean Bank Breaches, Poem-Guided Botnet, Empire Admin Gets 40 Years
SecurityWeek roundup: PoeLLM botnet resolves C&C via GitHub poem, GhostAction hit 772 repos, CrowdStrike links Chinese actor to Korean bank breaches.
58
Cryptomining botnet hides C2 addresses in GitHub poem, infects over 3,400 servers
PoeLLM cryptomining botnet infected 3,400+ servers running exposed LiteLLM, Ollama, and Gotenberg, decoding C2 addresses from a GitHub poem.
65
Hackers Use GitHub-Hosted Poem to Control PoeLLM Malware Targeting AI Infrastructure
PoeLLM malware uses a GitHub poem to derive C2 addresses and mine cryptocurrency on more than 3,400 exposed AI servers.
78
PoeLLM Malware Hijacks 3,400+ Servers for Crypto Mining and Botnet Expansion
PoeLLM has compromised over 3,400 servers, mining cryptocurrency and spreading through exposed AI and web apps.
78
Poetry is the new AI security threat as PoeLLM malware infects 3K+ servers
PoeLLM malware has infected over 3,000 servers since April, hiding command-and-control in a GitHub poem while mining cryptocurrency.
80
PoeLLM malware infects exposed AI servers in cryptomining attacks
PoeLLM cryptomining malware has compromised over 2,100 exposed AI servers, using GitHub poems for command-and-control.
76
PoeLLM malware has assembled a sweeping botnet, taking technical cues from a poem
PoeLLM malware has compromised over 3,400 servers, encoding its command-and-control address in a GitHub poem.
77
Midnight Blizzard Uses Captive Portals to Deliver CornFlake RAT and Steal Traveler Credentials
Midnight Blizzard's Storm-2945 resumed hotel captive-portal attacks that deliver CornFlake and steal traveler credentials.
78
Linux BambooToken Malware Uses MQTT C2 for Remote Shell Access and File Exfiltration
A Linux BambooToken backdoor uses MQTT on port 2883 for profiling, shell commands, and file theft.
56
BambooToken: The Malware That Speaks MQTT to Stay Under the Radar
Lumen's Black Lotus Labs uncovered BambooToken, a Windows and Linux malware family using MQTT broker-based C2 and DLL sideloading across Asia since February 2023.
56
DoJ Corrects China Hacking Claim, Says U.S. Agencies Were Targets, Not Victims
DoJ corrected its statement to say US federal agencies were targets, not confirmed victims, of China-linked group QTFY's intrusions.
70
Officials disrupt Chinese espionage operation that hit multiple federal agencies
FBI and DOJ seized QTFY infrastructure, disrupting a Chinese state-sponsored group that compromised federal agencies and critical infrastructure since 2018.
88
FBI Seizes China-Linked Hacking Platforms QScan and QTRouter Used Against Critical Infrastructure
FBI seizes China-linked QScan and QTRouter hacking platforms used by QTFY to obfuscate intrusions against US federal agencies.
78
Related CVEs
by mentions- CVE-2026-2012789%10.0Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator
- CVE-2026-168122%10.0OS Command Injection in Arista VeloCloud Orchestrator On-Prem
- CVE-2025-88753%9.4Insecure Deserialization Code Execution in N-able N-central (KEV)
- CVE-2025-88764%9.4OS Command Injection in N-able N-central Before 2025.3.1
- CVE-2026-4227191%8.7Command Injection in BerriAI LiteLLM AI Gateway Exploited in the Wild
- CVE-2024-397174%7.2Unrestricted File Upload in Versa Networks Versa Director Exploited by Volt Typhoon
- CVE-2026-10520100%10.0Unauthenticated OS Command Injection in Ivanti Sentry
- CVE-2019-11510100%10.0Unauthenticated Arbitrary File Read in Ivanti Pulse Connect Secure VPN
- CVE-2026-4871070%6.5HTTP Request Smuggling in Kludex Starlette (CVE-2026-48710)
- CVE-2026-47483<1%8.2NVIDIA DCGM Exporter for all platforms contains a vulnerability in the /debug/pprof endpoints, where an attacker could cause uncontrolled resource consumption…
Appears with
- Lumenorganization · 11
- Volt Typhoonthreat actor · 10
- Ciscovendor · 9
- VeloCloud Orchestratorproduct · 7
- Ivantivendor · 7
- FBIorganization · 6
- Versa Directorproduct · 6
- Questvendor · 5
- N-centralproduct · 5
- Versavendor · 5
- PoeLLMmalware · 5
- LiteLLMproduct · 5
- Gotenbergproduct · 5
- Cisco Catalyst SD-WANproduct · 5
- N-ablevendor · 5
- Giteaproduct · 5
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.