Volt Typhoon uses Silent Train relays for zero-day edge attacks
Original title: Volt Typhoon hides zero-day attacks using 'Silent Train' framework
Black Lotus Labs says four confirmed zero-days hit VeloCloud, Cisco SD-WAN, N-central, and Versa Director.
Black Lotus Labs says Chinese state-sponsored Volt Typhoon has used Silent Train, a rotating relay of compromised devices, for about three years, including zero-day attacks on edge and management systems. Targets span telecom, government, defense, education, utilities, satellite, IT, MSPs, transportation, aviation, and emergency services, with California, Texas, and Hawaii most often observed. Operators route through non-US VPS and hacked devices such as Intelbras modems and Netgear Orbi, then remove tooling after sessions that typically last under eight hours. Researchers link heavier use of the framework to the FBI’s disruption of KV-Botnet.
Unconfirmed: Quest KACE exploitation is only a suspected zero-day, and victim counts are not stated.
- Confirmed flaws are CVE-2026-16812, CVE-2026-20127, CVE-2025-8875, CVE-2025-8876, and CVE-2024-39717.
- Quest KACE is described only as a suspected zero-day.
- By early 2025 some enterprise systems were kept for one to three months.
- Operations were observed on China Standard Time and reserved for high-value targets.
Impact: Administrative control, stolen credentials, and downstream customer access
| Product | Affected |
|---|---|
| VeloCloud Orchestrator | — |
| Cisco Catalyst SD-WAN | — |
| N-able N-central | — |
| Versa Director | — |
| Quest KACE | — |
- 1.Restrict internet access to administrative interfaces on centralized management systems.
- 2.Patch exposed edge and management vulnerabilities quickly and retain centralized logs longer.
- 3.Follow CISA and NCSC guidance on Volt Typhoon.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1090 ProxyT1021.004 Remote Services: SSHT1070 Indicator RemovalT1078 Valid Accounts
- Products
- VeloCloud OrchestratorCisco Catalyst SD-WANN-able N-centralVersa DirectorQuest KACENetgear Orbi
- Threat actors
- Volt Typhoon
- Malware
- KV-BotnetSilent Train
- Organizations
- Black Lotus LabsLumenCISAFBINCSC
- Countries
- ChinaUnited States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-39717 | Unrestricted File Upload in Versa Networks Versa Director Exploited by Volt Typhoon | 7.2 | 4% | KEV | KEV |
CVE-2025-8876+1 related CVE | OS Command Injection in N-able N-central Before 2025.3.1 | 9.4 | 4% | KEV | KEV |
| CVE-2026-16812 | OS Command Injection in Arista VeloCloud Orchestrator On-Prem | 10.0 | 2% | KEV | KEV |
| CVE-2026-20127 | Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator | 10.0 | 89% | KEV | KEV |
From the original article
3 min read at bleepingcomputer.com
Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.