Lumen says Volt Typhoon banks Silent Train access in infrastructure
Lumen says the group rotates exploited SOHO, IoT and enterprise devices, including multiple zero-days, against high-value targets.
78
- Mentions · 7d7
- Mentions · 30d12
- All mentions15
- First seenAug 26, 2026
- Last mentioned1d ago
Timeline
15 articles · newest firstHackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware
CVE-2026-20127, patched in February 2026, lets attackers add rogue peers and steal IPsec key material from controllers.
84
Volt Typhoon used Silent Train for US zero-day intrusions
Lumen says four confirmed zero-day campaigns hit management platforms, with credential theft and chains of compromised devices.
84
Volt Typhoon used Silent Train relays to hide zero-day attacks
Lumen links the relay network to four confirmed zero-days and one likely flaw, with sessions rebuilt in under two minutes.
84
Cisco SD-WAN CVE-2026-20127 exploited to install KeyDrift key-stealing malware
The malware hooks vdaemon to copy AES-256 key material; Cisco calls exploitation limited and lists fixed trains.
84
Volt Typhoon uses Silent Train relays for zero-day edge attacks
Black Lotus Labs says four confirmed zero-days hit VeloCloud, Cisco SD-WAN, N-central, and Versa Director.
86
FBI seizes Virtualine bulletproof hosting domain
Prosecutors say the host ignored abuse notices, offered to move infrastructure after law-enforcement requests, and took unhosted Bitcoin payments.
62
FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails
FBI and six countries say China-linked Integrity Technology Group stole emails and shared them via a third-party portal.
79
Hackers Use GitHub-Hosted Poem to Control PoeLLM Malware Targeting AI Infrastructure
PoeLLM malware uses a GitHub poem to derive C2 addresses and mine cryptocurrency on more than 3,400 exposed AI servers.
78
PoeLLM Malware Hijacks 3,400+ Servers for Crypto Mining and Botnet Expansion
PoeLLM has compromised over 3,400 servers, mining cryptocurrency and spreading through exposed AI and web apps.
78
Poetry is the new AI security threat as PoeLLM malware infects 3K+ servers
PoeLLM malware has infected over 3,000 servers since April, hiding command-and-control in a GitHub poem while mining cryptocurrency.
80
PoeLLM malware infects exposed AI servers in cryptomining attacks
PoeLLM cryptomining malware has compromised over 2,100 exposed AI servers, using GitHub poems for command-and-control.
76
BambooToken: The Malware That Speaks MQTT to Stay Under the Radar
Lumen's Black Lotus Labs uncovered BambooToken, a Windows and Linux malware family using MQTT broker-based C2 and DLL sideloading across Asia since February 2023.
56
⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More
US agencies warn of AI-assisted attacks on exposed Siemens PLCs; the week also saw GitLab CVE-2026-19478 exploited and trojanized npm packages found.
65
FBI Seizes China-Linked Hacking Platforms QScan and QTRouter Used Against Critical Infrastructure
FBI seizes China-linked QScan and QTRouter hacking platforms used by QTFY to obfuscate intrusions against US federal agencies.
78
Related CVEs
by mentions- CVE-2026-2012789%10.0Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator
- CVE-2026-168122%10.0OS Command Injection in Arista VeloCloud Orchestrator On-Prem
- CVE-2025-88753%9.4Insecure Deserialization Code Execution in N-able N-central (KEV)
- CVE-2025-88764%9.4OS Command Injection in N-able N-central Before 2025.3.1
- CVE-2026-4227191%8.7Command Injection in BerriAI LiteLLM AI Gateway Exploited in the Wild
- CVE-2026-10520100%10.0Unauthenticated OS Command Injection in Ivanti Sentry
- CVE-2021-22205100%10.0Unauthenticated RCE in GitLab CE/EE via ExifTool Image Parsing (CVE-2021-22205)
- CVE-2021-319930%9.8Path Traversal RCE in ONLYOFFICE Document Server
- CVE-2016-308197%8.1Command injection RCE in Apache Struts Dynamic Method Invocation
- CVE-2014-6278100%—Remote OS Command Injection in GNU Bash via Crafted Environment (Shellshock-family)
Appears with
- Black Lotus Labsorganization · 11
- Volt Typhoonthreat actor · 6
- Ciscovendor · 5
- Ivantivendor · 5
- FBIorganization · 5
- Gotenbergproduct · 4
- XMRigmalware · 4
- Ollamaproduct · 4
- PoeLLMmalware · 4
- LiteLLMproduct · 4
- Giteaproduct · 4
- Versavendor · 3
- VeloCloud Orchestratorproduct · 3
- Ironmalware · 3
- Versa Directorproduct · 3
- Ivanti Sentryproduct · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.