Volt Typhoon used Silent Train relays to hide zero-day attacks
Lumen links the relay network to four confirmed zero-days and one likely flaw, with sessions rebuilt in under two minutes.
84
- Mentions · 7d3
- Mentions · 30d3
- All mentions3
- First seenOct 28, 2026
- Last mentioned1d ago
Timeline
3 articles · newest firstVolt Typhoon Exploits Zero-Days to Breach Critical Infrastructure
Volt Typhoon built Silent Train framework using zero-days in Quest KACE, N-central, Cisco SD-WAN and VeloCloud to access U.S. critical infrastructure.
80
Volt Typhoon used Silent Train in four zero-day campaigns
Black Lotus Labs says the rotating SOHO and IoT relay network hit hundreds of victims, including US critical infrastructure.
84
Related CVEs
by mentions- CVE-2026-2012789%10.0Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator
- CVE-2026-168122%10.0OS Command Injection in Arista VeloCloud Orchestrator On-Prem
- CVE-2025-88764%9.4OS Command Injection in N-able N-central Before 2025.3.1
- CVE-2025-88753%9.4Insecure Deserialization Code Execution in N-able N-central (KEV)
- CVE-2024-397174%7.2Unrestricted File Upload in Versa Networks Versa Director Exploited by Volt Typhoon
Appears with
- N-ablevendor · 3
- VeloCloud Orchestratorproduct · 3
- Ciscovendor · 3
- Black Lotus Labsorganization · 3
- Volt Typhoonthreat actor · 3
- N-centralproduct · 3
- Aristavendor · 2
- Questvendor · 2
- Catalyst SD-WANproduct · 2
- Versavendor · 2
- Versa Directorproduct · 2
- FRPmalware · 1
- Quest Softwarevendor · 1
- VersaMemmalware · 1
- Versa Networksvendor · 1
- VeloCloudvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.