Volt Typhoon used Silent Train relays to hide zero-day attacks
Original title: Volt Typhoon Used Silent Train to Hide Zero-Day Attacks
Lumen links the relay network to four confirmed zero-days and one likely flaw, with sessions rebuilt in under two minutes.
Lumen’s Black Lotus Labs says China-linked Volt Typhoon used Silent Train, a network of disposable compromised devices, to conceal exploitation of previously unknown flaws in management platforms. Chains typically passed through about four hops, ending on a US device near the target, and operators removed tools afterward. Confirmed campaigns hit Versa Director, N-able N-central, Cisco Catalyst SD-WAN, and VeloCloud Orchestrator. A moderate-confidence fifth campaign against Quest KACE affected more than 30 victims and declined after October 2025 updates. Activity was mostly weekday human operation on China Standard Time.
Unconfirmed: Lumen assesses the Quest KACE zero-day only at moderate confidence, and some relay compromises lacked a known vulnerability.
- N-central flaws are CVE-2025-8875 and CVE-2025-8876; Cisco’s CVE-2026-20127 is CVSS 10.0.
- VeloCloud Orchestrator was hit through CVE-2026-16812; exploitation of the Cisco bug continued after February 2026 disclosure.
- More than 27 device classes were used, including TP-Link, Netgear Orbi, and Fortinet.
- Sessions averaged about four hours and targeted one to five victims, often a single organization.
- Quest KACE is assessed only at moderate confidence despite limited forensic evidence.
Impact: Access to management platforms plus stolen credentials and data
| Product | Affected | Fixed in |
|---|---|---|
| Versa Director | — | — |
| N-able N-central | — | — |
| Cisco Catalyst SD-WAN | — | — |
| VeloCloud Orchestrator | — | — |
| Quest KACE | — | October 2025 security updates |
- 1.Apply vendor fixes for the named management-platform zero-days, including Quest’s October 2025 KACE updates.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1090.003 Multi-hop ProxyT1505.003 Web ShellT1070 Indicator Removal
- Threat actors
- Volt Typhoon
- Organizations
- LumenBlack Lotus Labs
- Countries
- ChinaUnited States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2025-8876+1 related CVE | OS Command Injection in N-able N-central Before 2025.3.1 | 9.4 | 4% | KEV | KEV |
| CVE-2026-16812 | OS Command Injection in Arista VeloCloud Orchestrator On-Prem | 10.0 | 2% | KEV | KEV |
| CVE-2026-20127 | Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator | 10.0 | 89% | KEV | KEV |
From the original article
4 min read at securityaffairs.com
Volt Typhoon used disposable relay chains to hide zero-day attacks on critical systems. Lumen linked Silent Train to at least four zero-days. Lumen’s Black Lotus Labs has spent three years tracking a covert network it calls Silent Train, which it ties to Volt Typhoon, the China-linked APT group.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.