Volt Typhoon used rotating Silent Train relays for zero-days
Lumen says exploited products included Versa, N-able, Cisco SD-WAN, VeloCloud and possibly Quest KACE; KeyDrift hit Cisco controllers.
86
- Mentions · 7d5
- Mentions · 30d5
- All mentions6
- First seenAug 28, 2026
- Last mentioned1d ago
Timeline
6 articles · newest firstVolt Typhoon used Silent Train for US zero-day intrusions
Lumen says four confirmed zero-day campaigns hit management platforms, with credential theft and chains of compromised devices.
84
Volt Typhoon used Silent Train relays to hide zero-day attacks
Lumen links the relay network to four confirmed zero-days and one likely flaw, with sessions rebuilt in under two minutes.
84
Volt Typhoon used Silent Train in four zero-day campaigns
Black Lotus Labs says the rotating SOHO and IoT relay network hit hundreds of victims, including US critical infrastructure.
84
Volt Typhoon uses Silent Train relays for zero-day edge attacks
Black Lotus Labs says four confirmed zero-days hit VeloCloud, Cisco SD-WAN, N-central, and Versa Director.
86
What 90 days and a small budget can buy in AI agent security
Versa Field CISO details hidden costs of self-hosting open-weight models and a 90-day AI agent security plan of inventory, blast-radius reduction and testing.
30
Related CVEs
by mentions- CVE-2026-2012789%10.0Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator
- CVE-2026-168122%10.0OS Command Injection in Arista VeloCloud Orchestrator On-Prem
- CVE-2025-88764%9.4OS Command Injection in N-able N-central Before 2025.3.1
- CVE-2025-88753%9.4Insecure Deserialization Code Execution in N-able N-central (KEV)
- CVE-2024-397174%7.2Unrestricted File Upload in Versa Networks Versa Director Exploited by Volt Typhoon
Appears with
- Volt Typhoonthreat actor · 5
- Ciscovendor · 5
- Versa Directorproduct · 5
- Black Lotus Labsorganization · 5
- Questvendor · 5
- VeloCloud Orchestratorproduct · 5
- N-ablevendor · 4
- N-centralproduct · 4
- Lumenorganization · 3
- Cisco Catalyst SD-WANproduct · 3
- Quest KACEproduct · 3
- Chiselmalware · 2
- FRPmalware · 2
- KACEproduct · 2
- Intelbrasvendor · 1
- Silent Trainmalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.