Researchers at Lumen’s Black Lotus Labs say the China-linked group Volt Typhoon has spent roughly three years running a covert relay framework they call Silent Train. Instead of keeping a fixed set of hacked devices, the operators build a fresh chain for each job: a rented server outside the U.S., a second rented server, hacked home or small-office routers and IoT devices in other countries, and finally a hacked U.S. device that gives the traffic a domestic exit point before it reaches the victim. Lumen says chains averaged about four hops before reaching U.S. address space, could be assembled in under two minutes, and were taken apart afterward with the temporary SSH services, keys and configuration files removed. Sessions averaged about four hours.
Lumen confirmed four zero-day campaigns run through Silent Train: Versa Director (CVE-2024-39717, which Black Lotus Labs documented publicly in 2024), N-able N-central (CVE-2025-8875 and CVE-2025-8876), Cisco Catalyst SD-WAN (CVE-2026-20127) and VeloCloud Orchestrator (CVE-2026-16812). It also assessed, with moderate confidence and limited logs, that Quest KACE was hit by a suspected zero-day affecting more than 30 victims. Targets named in the report include U.S. government bodies, telecommunications and satellite providers, defense contractors, utilities, managed service providers and IT firms. Lumen says the operators worked in China Standard Time hours and used built-in platform features, in-memory webshells and credential harvesting, and in several cases altered or erased logs.
Lumen links Silent Train’s growth partly to the FBI’s disruption of the KV-Botnet, which Volt Typhoon had used earlier to hide its attacks. We have covered several of the individual flaws, including the exploited VeloCloud Orchestrator SQL injection and the joint advisory on covert SOHO router networks.
How to check if you’re affected
Affected products are the management platforms named in Lumen’s report: Quest KACE, N-able N-central, Cisco Catalyst SD-WAN, VeloCloud Orchestrator and Versa Director (CVE ids as listed above, per Lumen and BleepingComputer). The report does not publish a fixed-version table, so use each vendor’s advisory for the CVE ids above. Lumen noted that Quest’s October 2025 security updates coincided with the KACE activity declining, and that Cisco disclosed CVE-2026-20127 in February 2026 while exploitation continued afterward.
Lumen’s defender recommendations, in its words and ours:
- Treat management and control-plane systems (SD-WAN orchestrators, endpoint management, out-of-band platforms) as high-value and review the permissions and downstream trust they grant.
- Reduce internet exposure of administrative interfaces by placing them behind VPNs, jump hosts or a dedicated management network.
- Patch centralized management platforms first.
- Centralize logs and extend retention, because the actors deleted local evidence.
- Hunt for unusual administrative logins, abnormal API use, remote file transfers and configuration changes outside normal working hours.
Lumen also points to CISA and NCSC guidance on Volt Typhoon and on China-nexus networks of compromised devices. Lumen says relay devices it saw used included TP-Link routers, Netgear Orbi devices, Intelbras modems, Fortinet appliances and CyberPanel servers, so internet-facing small-office devices of those types are worth checking for unexpected SSH services or keys.
Sources
- Silent Train: uncovering Volt Typhoon’s operational framework for zero-day exploitation and strategic access (Lumen Black Lotus Labs)
- Volt Typhoon hides zero-day attacks using ‘Silent Train’ framework (BleepingComputer)
- Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns (The Hacker News)