Volt Typhoon used Silent Train in four zero-day campaigns
Original title: Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns
Black Lotus Labs says the rotating SOHO and IoT relay network hit hundreds of victims, including US critical infrastructure.
Lumen Technologies Black Lotus Labs attributes the covert Silent Train access network to China-nexus Volt Typhoon. The network chains compromised SOHO, IoT, and enterprise devices for exploitation, credential access, exfiltration, and short-lived SSH relays, then removes artifacts. Four confirmed zero-days are Versa Director CVE-2024-39717, N-able N-central CVE-2025-8875 and CVE-2025-8876, Cisco Catalyst SD-WAN Controller CVE-2026-20127, and Arista VeloCloud Orchestrator CVE-2026-16812. Hundreds of victims span telecom, government, defense, universities, and critical infrastructure.
Unconfirmed: Use of a Quest KACE flaw is described as suspected and a likely zero-day, not one of the four confirmed campaigns.
- Silent Train was first identified in late 2023 and uses one-time multi-hop device chains.
- VersaMem was delivered through the Versa Director file-upload zero-day CVE-2024-39717.
- A suspected Quest KACE zero-day, patched in October 2025, is estimated at more than 30 victims.
- At least 27 device classes, including TP-Link, Fortinet, and Cisco gear, were enrolled as relays.
- Sessions started on non-US VPS infrastructure and exited through US-based compromised devices.
Impact: Zero-day access, credential theft, and data exfiltration
| Product | Affected | Fixed in |
|---|---|---|
| Versa Director | — | — |
| N-able N-central | — | — |
| Cisco Catalyst SD-WAN Controller | — | — |
| Arista VeloCloud Orchestrator | — | — |
| Quest KACE | — | patched in October 2025 |
- 1.Review exposure of Versa Director, N-central, Catalyst SD-WAN Controller, and VeloCloud Orchestrator to the named flaws.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1090.003 Multi-hop ProxyT1021.004 Remote Services: SSHT1070 Indicator RemovalT1041 Exfiltration Over C2 Channel
- Threat actors
- Volt Typhoon
- Malware
- VersaMem
- Organizations
- Black Lotus LabsLumen Technologies
- Countries
- ChinaUnited States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-39717 | Unrestricted File Upload in Versa Networks Versa Director Exploited by Volt Typhoon | 7.2 | 4% | KEV | KEV |
CVE-2025-8876+1 related CVE | OS Command Injection in N-able N-central Before 2025.3.1 | 9.4 | 4% | KEV | KEV |
| CVE-2026-16812 | OS Command Injection in Arista VeloCloud Orchestrator On-Prem | 10.0 | 2% | KEV | KEV |
| CVE-2026-20127 | Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator | 10.0 | 89% | KEV | KEV |
From the original article
5 min read at thehackernews.com
The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been put to use for zero-day exploitation and strategic access. "First identified in late 2023, Silent Train uses rotating chains of compromised SOHO, IoT, and enterprise infrastructure," Lumen Technologies Black Lotus Labs said in a report shared
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.