Volt Typhoon used rotating Silent Train relays for zero-days
Original title: Volt Typhoon targeted enterprise control planes via ever-changing “Silent Train” relay network
Lumen says exploited products included Versa, N-able, Cisco SD-WAN, VeloCloud and possibly Quest KACE; KeyDrift hit Cisco controllers.
Lumen’s Black Lotus Labs says Chinese state-sponsored Volt Typhoon used Silent Train, a constantly rebuilt chain of compromised SOHO, IoT and enterprise devices, to reach US government, telecom, defense and critical-infrastructure targets. Operators exploited zero-days in network control-plane products, planted in-memory webshells, harvested credentials and altered logs. Cisco Talos says UAT-11473, whose infrastructure overlaps Silent Train, exploited CVE-2026-20127 on Cisco SD-WAN Catalyst Controllers and deployed KeyDrift to steal session metadata and data-plane keying material. The network predates the December 2023 KV botnet takedown.
Unconfirmed: Quest KACE may involve an unknown zero-day, and not every listed edge product was tied to a confirmed flaw.
- Named flaws include CVE-2024-39717, CVE-2025-8875, CVE-2025-8876, CVE-2026-20127 and CVE-2026-16812.
- Chains spanned more than 27 device classes and as many as six hops.
- Some paths used Chisel and FRP reverse tunnels instead of sequential SSH pivots.
- Hawaii, California and Texas were the most frequently targeted states.
- Monitoring over three years produced hundreds of victim notifications.
Impact: Persistent controller access and theft of keying material
| Product | Affected |
|---|---|
| Versa Director | — |
| N-able N-central | — |
| Cisco Catalyst SD-WAN | — |
| VeloCloud Orchestrator | — |
| Quest KACE | — |
- 1.Check Versa Director, N-central, Cisco Catalyst SD-WAN, VeloCloud Orchestrator and Quest KACE for compromise.
- 2.Hunt for Silent Train relay hops, in-memory webshells and KeyDrift on SD-WAN controllers.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1090 ProxyT1572 Protocol TunnelingT1505.003 Web ShellT1070 Indicator Removal
- Threat actors
- Volt TyphoonUAT-11473
- Malware
- KeyDrift
- Organizations
- Black Lotus LabsCisco Talos
- Countries
- United StatesChina
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-39717 | Unrestricted File Upload in Versa Networks Versa Director Exploited by Volt Typhoon | 7.2 | 4% | KEV | KEV |
CVE-2025-8876+1 related CVE | OS Command Injection in N-able N-central Before 2025.3.1 | 9.4 | 4% | KEV | KEV |
| CVE-2026-16812 | OS Command Injection in Arista VeloCloud Orchestrator On-Prem | 10.0 | 2% | KEV | KEV |
| CVE-2026-20127 | Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator | 10.0 | 89% | KEV | KEV |
From the original article
4 min read at helpnetsecurity.com
Volt Typhoon, a Chinese state-sponsored APT group that’s focused on cyberespionage and United States’ critical infrastructure, has been using a covert, constantly rotating relay network to hide its most sensitive intrusions, Lumen’s Black Lotus Labs revealed on Wednesday. This network, dubbed Silent Train by the researchers, consists of chains of compromised SOHO and IoT devices (e. g.
By Zeljka Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.