Volt Typhoon Exploits Zero-Days to Breach Critical Infrastructure
Original title: Volt Typhoon Hackers Exploit Multiple Zero-Days to Breach U.S. Critical Infrastructure Networks
Volt Typhoon built Silent Train framework using zero-days in Quest KACE, N-central, Cisco SD-WAN and VeloCloud to access U.S. critical infrastructure.
Chinese state-sponsored Volt Typhoon exploited multiple zero-days in enterprise management platforms to penetrate critical organizations. Over three years Black Lotus Labs notified hundreds of victims. The Silent Train framework chained compromised devices for covert access, including SOHO routers and IoT equipment. Targets included Quest KACE, N-able N-central, Cisco Catalyst SD-WAN and VeloCloud Orchestrator.
- Zero-days in Quest KACE and N-central
- CVE-2026-20127 in Cisco SD-WAN
- CVE-2026-16812 in VeloCloud
- Silent Train assembly under 2 minutes
- Sessions averaged 4 hours
Impact: Unauthorized access to critical infrastructure networks
- 1.Apply vendor patches
- 2.Review management server logs
- 3.Rotate credentials
- Threat actors
- Volt Typhoon
- Organizations
- Black Lotus Labs
- Countries
- China
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2025-8876+1 related CVE | OS Command Injection in N-able N-central Before 2025.3.1 | 9.4 | 4% | KEV | KEV |
| CVE-2026-16812 | OS Command Injection in Arista VeloCloud Orchestrator On-Prem | 10.0 | 2% | KEV | KEV |
| CVE-2026-20127 | Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator | 10.0 | 89% | KEV | KEV |
From the original article
3 min read at gbhackers.com
Chinese state-sponsored hacking group Volt Typhoon has exploited multiple previously unknown vulnerabilities in enterprise management platforms to penetrate strategically significant organizations. Its investigation exposed Silent Train, a covert access framework built from rapidly rotating chains of compromised devices.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.