Volt Typhoon used Silent Train for US zero-day intrusions
Original title: Chinese Hackers Use Secret Silent Train Network to Exploit Zero-Days Against U.S. Government and Defense
Lumen says four confirmed zero-day campaigns hit management platforms, with credential theft and chains of compromised devices.
Lumen's Black Lotus Labs says China-linked Volt Typhoon used a covert routing framework it calls Silent Train to hide intrusions against US government agencies, defense contractors, and critical infrastructure. Tracked since November 2023, the network chained compromised routers, connected devices, and servers, then targeted centralized management platforms. The October 28 report describes four confirmed zero-day campaigns and one likely campaign, including N-central, Versa Director, Cisco Catalyst SD-WAN, and VeloCloud Orchestrator. Operators harvested credentials, used in-memory webshells, and sometimes altered or erased logs.
Unconfirmed: The Quest KACE zero-day link is moderate confidence, and researchers could not identify the access method for every product.
- Researchers issued hundreds of victim notifications over about three years of tracking.
- N-central CVEs are CVE-2025-8875 and CVE-2025-8876; Cisco is CVE-2026-20127; VeloCloud is CVE-2026-16812.
- Some chains used as many as six hops and were assembled in under two minutes.
- A Quest KACE campaign affected more than 30 victims; the zero-day link is moderate confidence.
- Hawaii, California, and Texas repeatedly appeared as targeting hotspots.
Impact: Stolen credentials and trusted access into managed customer networks
| Product | Affected |
|---|---|
| N-central | — |
| Cisco Catalyst SD-WAN | — |
| VeloCloud Orchestrator | — |
| Versa Director | — |
| Quest KACE | — |
- 1.Restrict internet-facing management interfaces and prioritize vendor patches.
- 2.Review downstream trust from endpoint managers and SD-WAN controllers.
- 3.Export logs off-platform and investigate unusual admin, API, and transfer activity.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1090.003 Multi-hop ProxyT1505.003 Web ShellT1572 Protocol TunnelingT1070 Indicator Removal
- Threat actors
- Volt Typhoon
- Organizations
- LumenBlack Lotus Labs
- Countries
- ChinaUnited States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2025-8876+1 related CVE | OS Command Injection in N-able N-central Before 2025.3.1 | 9.4 | 4% | KEV | KEV |
| CVE-2026-16812 | OS Command Injection in Arista VeloCloud Orchestrator On-Prem | 10.0 | 2% | KEV | KEV |
| CVE-2026-20127 | Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator | 10.0 | 89% | KEV | KEV |
From the original article
4 min read at cybersecuritynews.com
China-linked Volt Typhoon hackers have used a covert network called Silent Train to hide zero-day attacks against U. S. government agencies, defense contractors and critical infrastructure.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.