Volt Typhoon used rotating Silent Train relays for zero-days
Lumen says exploited products included Versa, N-able, Cisco SD-WAN, VeloCloud and possibly Quest KACE; KeyDrift hit Cisco controllers.
86
Product
Versa Director
- Mentions · 7d6
- Mentions · 30d6
- All mentions6
- First seenOct 28, 2026
- Last mentioned1d ago
Timeline
6 articles · newest firstVolt Typhoon used Silent Train for US zero-day intrusions
Lumen says four confirmed zero-day campaigns hit management platforms, with credential theft and chains of compromised devices.
84
Volt Typhoon used Silent Train relays to hide zero-day attacks
Lumen links the relay network to four confirmed zero-days and one likely flaw, with sessions rebuilt in under two minutes.
84
Volt Typhoon used Silent Train in four zero-day campaigns
Black Lotus Labs says the rotating SOHO and IoT relay network hit hundreds of victims, including US critical infrastructure.
84
Volt Typhoon uses Silent Train relays for zero-day edge attacks
Black Lotus Labs says four confirmed zero-days hit VeloCloud, Cisco SD-WAN, N-central, and Versa Director.
86
Volt Typhoon rebuilt Silent Train relay chains since late 2023
Black Lotus Labs says chains were rebuilt in under two minutes and hundreds of victims were notified.
84
Related CVEs
by mentions- CVE-2026-2012789%10.0Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator
- CVE-2026-168122%10.0OS Command Injection in Arista VeloCloud Orchestrator On-Prem
- CVE-2025-88764%9.4OS Command Injection in N-able N-central Before 2025.3.1
- CVE-2025-88753%9.4Insecure Deserialization Code Execution in N-able N-central (KEV)
- CVE-2024-397174%7.2Unrestricted File Upload in Versa Networks Versa Director Exploited by Volt Typhoon
Appears with
- VeloCloud Orchestratorproduct · 6
- Volt Typhoonthreat actor · 6
- Black Lotus Labsorganization · 6
- Ciscovendor · 6
- Questvendor · 5
- Versavendor · 5
- Cisco Catalyst SD-WANproduct · 4
- N-ablevendor · 4
- N-centralproduct · 4
- Lumenorganization · 3
- Quest KACEproduct · 3
- Silent Trainmalware · 2
- Netgearvendor · 2
- Lumen Technologiesorganization · 2
- FRPmalware · 2
- FBIorganization · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.