Volt Typhoon hid zero-day attacks behind Silent Train relay framework

Lumen's Black Lotus Labs says it has tracked for three years a relay framework it calls Silent Train, used by the Chinese state sponsored group Volt Typhoon against select high value targets. The framework, built partly after the FBI disrupted the group's KV-Botnet, routes attacks through rotating chains of compromised routers, IoT devices and enterprise systems, including Intelbras modems overseas and Netgear Orbi devices in the United States, then removes its tooling, keys and configuration files after sessions that typically lasted under eight hours. Targets included telecommunications firms, government agencies, defense contractors, universities, utilities and other critical infrastructure, satellite providers, IT firms and managed service providers, transportation, aviation and emergency services, concentrated in California, Texas and Hawaii.

Black Lotus Labs says monitoring Silent Train let it observe Volt Typhoon exploiting at least four zero day vulnerabilities in edge and management platforms: VeloCloud Orchestrator CVE-2026-16812, Cisco Catalyst SD-WAN CVE-2026-20127, N-able N-central CVE-2025-8875 and CVE-2025-8876, and Versa Director CVE-2024-39717, plus a suspected Quest KACE zero day. Compromising those platforms gives broad administrative control, credential theft and reach into downstream customers. Nextgov, citing anonymous sources, adds that Energy Department facilities were targeted over the last year and that multiple utilities have dealt with Volt Typhoon issues over a similar timeframe.

Sources: BleepingComputer; Nextgov