Volt Typhoon Silent Train Zero-Day Attacks Explained: The Self-Erasing Relay Network Hiding Four Campaigns

Illustrative image: server racks at CERN. Silent Train is not a device — it is a relay framework built from compromised routers, IoT devices and enterprise systems — so this image illustrates the infrastructure at stake, not the attack itself. Image: Wikimedia Commons

TL;DR — Volt Typhoon Silent Train zero-day attacks explained in one line: on 28 October 2026, Lumen's Black Lotus Labs revealed that the China-linked hacking group Volt Typhoon has hidden at least four zero-day campaigns since late 2023 behind "Silent Train" — chains of hacked home routers, IoT devices and enterprise systems that are assembled in under two minutes, used for about four hours, then wiped clean.

📌 KEY HIGHLIGHTS

• The revelation: Lumen's Black Lotus Labs published its Silent Train report on 28 October 2026 after tracking the framework for three years, since late 2023.
• How it hides attacks: traffic hops through about four compromised devices on average (up to six) — rented servers abroad, then overseas routers, then a device inside the US near the victim — so the attack looks like local traffic.
• Four confirmed zero-days: Versa Director, N-able N-central, Cisco Catalyst SD-WAN and Arista VeloCloud Orchestrator — all platforms that manage other systems. A fifth, against Quest KACE, is suspected.
• Who was hit: hundreds of victims were notified, across telecoms, government, defence contractors, universities, utilities, transport and satellite providers — concentrated in California, Texas and Hawaii.
• Why it is hard to stop: there is almost no standing infrastructure to seize. A chain can be rebuilt with fresh devices in under two minutes, and sessions are cleaned up afterwards.

Volt Typhoon Silent Train zero-day attacks explained: what happened?

Volt Typhoon is a hacking group that researchers attribute to China and that Western governments have long accused of pre-positioning inside US critical infrastructure — quietly gaining access to systems that would matter in a crisis, rather than attacking them outright. Its earlier network, the KV-botnet of hijacked home routers, was disrupted by the FBI and US Justice Department in early 2024. According to Lumen, Silent Train is what came next — and it is deliberately harder to disrupt.

Silent Train first appeared in November 2023, shortly before that first KV-botnet takedown, and its activity rose after the second disruption. Instead of maintaining a persistent botnet that defenders can map and seize, Volt Typhoon moved to disposable chains: compromised devices borrowed for a single operation and then discarded. Black Lotus Labs says it has sent hundreds of victim notifications over the three years, and the investigations that followed uncovered at least four confirmed zero-day campaigns — attacks exploiting flaws the vendors did not yet know about — plus one likely campaign.

The crucial point Lumen stresses is the target choice. Every confirmed zero-day campaign through Silent Train hit a centralised management platform — the console that administers a whole network, rather than one computer on it. Compromise the console and you inherit its reach: credentials, remote access and visibility across every device and customer it manages, without the noisy lateral movement that usually trips alarms. As the report puts it, systems with broad administrative reach "can become high-value gateways to the entire organization and its customers."

How Silent Train works: a chain built to disappear

A Silent Train session starts on a rented virtual server outside the United States. From there, traffic passes through another server and a chain of compromised small-office and home-office routers, IoT devices and enterprise systems in other countries, before a final hop through a compromised device inside the US, close to the target. The roles are strikingly fixed, Lumen found: Intelbras modems served only as overseas relays, while Netgear Orbi devices acted only as the US-facing hops. More than 27 device classes appear in the framework, from TP-Link routers and Netgear gear to Fortinet appliances, CyberPanel servers and PRTG monitoring systems — and some relay device types had no known vulnerability at all, suggesting, Lumen says, that previously undisclosed exploits may have been spent just to build a single relay hop.

To turn a device into a relay, the operators exploited its exposed web interface, then installed only the minimum tooling needed for chained SSH access: a temporary SSH service, keys, configuration files and tools already present on the system. Sessions lasted about four hours on average, some only minutes, and some under eight hours at the outer end. When the session ended, the operators removed their tooling, keys and configuration files and dismantled the chain. By early 2025 the framework had also become hybrid: disposable relays alongside some compromised enterprise systems retained for one to three months. That is why Lumen cautions that its observations "should not be interpreted as a complete census of Volt Typhoon activity" — the network, by design, leaves almost nothing standing between operations.

Illustrative image: server racks at the NOIRLab Headquarters computer server room. Management consoles for networks like this are Silent Train's preferred target, because one console reaches everything it administers. Image: Wikimedia Commons / NOIRLab / NSF / AURA / T. Slovinský, CC BY 4.0

The four zero-day campaigns

All four confirmed campaigns targeted management or control-plane platforms, and all four vendors have since released fixes — which is why patching these specific products is the first action in Lumen's advice, not a generic "update everything" note:

Platform hit	Flaw	What it gave the attackers
Versa Director	CVE-2024-39717	Exploited to deploy the VersaMem web shell on a network management platform.
N-able N-central	CVE-2025-8875 and CVE-2025-8876	Endpoint management platform flaws used to reach managed devices at scale.
Cisco Catalyst SD-WAN	CVE-2026-20127 (CVSS 10.0)	Unauthenticated bypass of SD-WAN controller peering authentication, giving admin rights; Lumen says exploitation continued after Cisco's 25 February 2026 disclosure.
Arista VeloCloud Orchestrator	CVE-2026-16812	Unauthenticated operating-system command injection reachable through the web interface of the SD-WAN orchestrator.

Separately, Cisco's Talos team reported on the same day that a threat actor it tracks as UAT-11473 exploited the same Cisco SD-WAN flaw to plant KeyDrift malware designed to harvest encryption keys. Talos assesses with high confidence that UAT-11473's infrastructure "overlaps considerably" with Silent Train — it does not say the two are the same group, and this post does not merge them. A suspected fifth campaign, against Quest KACE, is reported to have affected more than 30 victims, but Lumen lists it as suspected rather than confirmed, so treat it as an open lead, not a finding.

Why it matters for India readers

No Indian victim is named in the reports checked for this post, and this post claims none. The relevance is practical, not geographic. The same platforms Silent Train targeted — Cisco SD-WAN controllers, Versa Director, N-able N-central and VeloCloud Orchestrator — are used by Indian enterprises, telecom operators, managed service providers and IT firms, and the same TP-Link and Netgear routers sit in Indian homes and branch offices. A relay chain does not care where a router lives; it cares that the router is reachable, unpatched and forgotten.

There is also a lesson for India's own critical-infrastructure and services networks, which run the same centralised management model: an internet-facing admin console is not just one more server, it is the key to everything behind it. Lumen's advice applies directly — take management consoles off the public internet wherever possible, put them behind a jump host or dedicated management network, patch the management platforms first (before the endpoints they manage), centralise their logs and keep them longer, and watch for the artefacts a short session still leaves while it runs: new SSH services, unfamiliar authorised-keys entries and fresh configuration files on network appliances. Geofencing and IP-reputation blocking, Lumen warns, are not a defence here, because Silent Train deliberately exits through a device inside the victim's own country.

Read this alongside our Warp Panda VMware ESX flaw CISA KEV explainer, our Cisco ASA FTD VPN flaw exploited explainer and our Fragnesia Linux kernel flaw CISA KEV explainer — October 2026's running theme is that the edge and management devices nobody thinks about are now the main battleground.

Should you care? ✅ / ⏳

Verdict: ✅ If you run Versa Director, N-able N-central, Cisco Catalyst SD-WAN or VeloCloud Orchestrator — or you manage networks through any internet-facing console — check your patch level and your console's internet exposure today. ⏳ Everyone else should still do the home version: update your router's firmware, change its default admin password, and switch off remote management if you do not use it — because the devices Silent Train borrows are usually somebody's forgotten router.

FAQs

What is Silent Train? Silent Train is the name Lumen's Black Lotus Labs gives to a covert relay framework attributed to the China-linked group Volt Typhoon. It is not a single network but a series of short-lived chains of compromised home-office routers, IoT devices and enterprise systems, assembled for one operation and then dismantled, used since late 2023 to hide zero-day attacks on management platforms.

How does Silent Train work? Attack traffic starts on a rented server outside the US, hops through about four compromised devices on average (up to six) — overseas relays, then a US-based device near the victim — and reaches the target looking like local traffic. Operators install only temporary SSH tooling on each relay, run a session averaging about four hours, then remove every artefact. A fresh chain can be rebuilt in under two minutes.

Which zero-days did Silent Train exploit? Four confirmed campaigns: Versa Director (CVE-2024-39717), N-able N-central (CVE-2025-8875 and CVE-2025-8876), Cisco Catalyst SD-WAN (CVE-2026-20127, CVSS 10.0) and Arista VeloCloud Orchestrator (CVE-2026-16812). A campaign against Quest KACE is suspected, affecting more than 30 victims, but not confirmed.

How do organisations defend against Silent Train? Lumen's priorities are: restrict internet access to administrative interfaces, patch management platforms first, segment consoles behind jump hosts and dedicated management networks, centralise and retain logs for longer, and monitor for unusual administrative activity such as new SSH services or authorised-keys entries. Do not rely on geofencing or IP reputation alone, since the final hop is deliberately domestic.

Was India targeted by Silent Train? The reports checked for this post name US victims concentrated in California, Texas and Hawaii, across telecoms, government, defence, utilities and other sectors, and name no Indian victim. Indian relevance comes from the shared platforms and router models involved, and from the same management-console exposure in Indian networks — not from a claimed Indian incident.

Is Silent Train still active? Lumen's report documents activity tracked over three years to October 2026, and notes that the framework's disposable design means observations cannot be a complete census. The report does not declare the framework dismantled, and all four confirmed flaws now have vendor fixes — so the defensive advice stands whether or not a given chain is live today.

Takeaway: The scariest part of Silent Train is not any single zero-day — it is that the attack infrastructure itself is designed to vanish. When the road into a network erases itself after every trip, the only durable defences are patching the consoles, hiding them from the internet, and keeping logs long enough to see the four-hour visit.

Follow World Tech on TechByCountry for tomorrow's update.

📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.

Sources

• SecurityWeek — Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon's 'Silent Train' Network (28–29 Oct 2026)
• Help Net Security — Volt Typhoon targeted enterprise control planes via ever-changing "Silent Train" relay network (29 Oct 2026)
• Nextgov — China's 'Volt Typhoon' quietly built another hacking network following US crackdown, new findings say (28 Oct 2026)
• SecurityAffairs — Volt Typhoon Used Silent Train to Hide Zero-Day Attacks (29 Oct 2026)