Silent Train: Volt Typhoon zero-day campaign against edge and management infrastructure
Severity: critical · Patch status: partial · Since 2026-10-28 · CVE-2024-39717, CVE-2025-8875, CVE-2025-8876, CVE-2026-16812, CVE-2026-20127
Lumen's Black Lotus Labs reports that China-linked Volt Typhoon has operated a covert relay framework dubbed Silent Train since late 2023, built from rapidly rotating chains of compromised SOHO routers, IoT devices and enterprise infrastructure. Chains are assembled in under two minutes, sessions last roughly four to eight hours, and tooling is wiped afterwards, making the network effectively undisruptable. The group used it to exploit at least four zero-days (VeloCloud Orchestrator CVE-2026-16812, Cisco Catalyst SD-WAN CVE-2026-20127, N-able N-central CVE-2025-8875/8876, Versa Director CVE-2024-39717) plus a suspected Quest KACE zero-day, targeting telecoms, government, defense contractors, utilities and other critical infrastructure, concentrated in California, Texas and Hawaii. Adoption increased after the FBI disrupted the KV Botnet in early 2024. Mitigations include patching, restricting admin interfaces, and centralized logging.
What to do
- Rapidly patch the listed zero-days on VeloCloud Orchestrator, Cisco Catalyst SD-WAN, N-able N-central, Versa Director and Quest KACE
- Restrict internet exposure of administrative and management interfaces on edge and management platforms
- Centralize logs with longer retention and monitor for unusual administrative activity and short-lived SSH keys/services
- Review trusted connections that could expose customer or partner networks
- Follow CISA and NCSC Volt Typhoon guidance and harden centralized management systems
Sources
All live incidents on Threat Watch
