Volt Typhoon's Silent Train Network Hid Four Zero-Day Campaigns Against Management Planes

TL;DR

• what: Lumen Black Lotus Labs attributed Silent Train, a covert multi-hop access network active since late 2023 and now disrupted, to the China-nexus group Volt Typhoon.
• impact: Silent Train carried four confirmed zero-day campaigns against endpoint management, network management, SD-WAN and orchestration platforms, reaching hundreds of victims in telecom, government, defense and critical infrastructure.
• fix: The exploited flaws are CVE-2024-39717 (Versa Director), CVE-2025-8875 and CVE-2025-8876 (N-able N-central), CVE-2026-20127 (Cisco Catalyst SD-WAN Controller) and CVE-2026-16812 (Arista VeloCloud Orchestrator), plus a Quest KACE flaw patched in October 2025; vendor patches for each are the primary mitigation.
• who: Telecom providers, managed service providers, defense contractors, satellite and emergency communications, universities and water, energy and transportation operators running exposed management platforms.

Volt Typhoon ran at least four zero-day exploitation campaigns through a covert access network that defenders did not see for most of its life. Lumen Technologies' Black Lotus Labs has named the network Silent Train, attributed it to the China-nexus group, and confirmed it has been disrupted. Hundreds of victims were identified across telecommunications, government, defense contractors, satellite and mission-critical communications, universities, IT firms, and critical infrastructure including water, energy, transportation, maritime, rail, aviation and emergency services.

The targets were not random. Volt Typhoon went after the systems that manage other systems: endpoint management platforms, network management systems, SD-WAN orchestrators and control plane technologies. Compromising one of these gives an operator visibility and control across a large enterprise, and in the case of service providers, access to downstream customers.

Four Zero-Days, One Pattern

Black Lotus Labs confirmed four zero-day campaigns conducted through Silent Train. Every one hit a management or orchestration product:

• CVE-2024-39717: a file upload flaw in Versa Director, previously known to have been used to drop the VersaMem web shell for credential harvesting and downstream customer access.
• CVE-2025-8875 and CVE-2025-8876: insecure deserialization and command injection flaws in N-able N-central, a remote monitoring and management platform widely used by MSPs.
• CVE-2026-20127: an authentication bypass in the Cisco Catalyst SD-WAN Controller.
• CVE-2026-16812: an operating system command injection flaw in Arista VeloCloud Orchestrator.

Black Lotus Labs also suspects Volt Typhoon exploited a likely zero-day in Quest KACE before it was patched in October 2025. That campaign is estimated to have affected more than 30 victims.

⚠️ Why the target set matters — RMM platforms, SD-WAN controllers and orchestrators sit above the network they manage. A single compromise can expose credentials, configurations and push capability across every site or customer the platform touches. For an actor focused on pre-positioning in US critical infrastructure, these products offer the most access per exploit.

How Silent Train Was Built

Black Lotus Labs describes Silent Train as a layered, multi-hop framework. Operator traffic passes through several compromised devices before reaching the victim, and each layer has a defined role:

• Entry: virtual private servers located outside the US act as temporary staging. Operators provision them for a session and discard them afterward.
• Obfuscation: compromised non-US SOHO and IoT devices spread across different countries, providers and hardware conceal where the session started.
• Exit: compromised US-based devices serve as the final hop before the domestic victim, defeating geofencing and IP reputation blocklists.

At least 27 device classes were exploited and enrolled. On the consumer and IoT side these included TP-Link, Intelbras, Ruckus Wireless, SATO, NETGEAR, Zyxel and Cambium. Enterprise platforms in the relay pool included Fortinet, Cisco, PRTG, Mirth Connect and CyberPanel. Any of these exposed to the internet could have served as a hop without the owner knowing their device was carrying nation-state traffic.

Discipline Over Persistence

Silent Train differs from earlier Chinese relay networks in that it was not a standing botnet. Operators exploited exposed web interfaces on relay devices on demand, then deployed only what was needed to chain SSH access through the node: temporary SSH services, keys, configuration files and living-off-the-land utilities. When the session ended, they removed their tooling.

Black Lotus Labs summarized the model as rapidly rotating chains of devices that are exploited on demand, used against carefully selected targets, cleaned up after each operation and continuously refreshed. There was no persistent C2 server to sinkhole and no long-lived relay to fingerprint. Each chain was effectively single use.

Detection impact — Because chains were torn down after each session and exit nodes sat inside the US, indicators from one intrusion had little value for spotting the next. IP blocklists and geographic filters were specifically defeated by design.

A Direct Response to KV-Botnet Takedowns

The timeline suggests Silent Train was Volt Typhoon's answer to losing its previous infrastructure. The capability began to take shape around November 2023, weeks before the first disruption of KV-botnet, an IoT botnet tied to multiple China-nexus actors including Volt Typhoon. After the second KV-botnet disruption in late January 2024, Silent Train activity surged and shifted to ephemeral infrastructure spanning diverse device types and geographies.

In Black Lotus Labs' words, Volt Typhoon moved away from persistent infrastructure to one-time-use chains it could rebuild as needed, producing a resilient, compartmentalized framework that protected its access. Takedowns of persistent botnets imposed cost, and the actor adapted by eliminating the persistent component entirely.

RedEye Assessment

Silent Train confirms two trends security teams should plan around. First, Volt Typhoon is investing zero-days specifically in management plane products, and it has done so repeatedly across at least five vendors: Versa, N-able, Cisco, Arista and likely Quest. Organizations that run these platforms, and MSPs that run them on behalf of customers, are priority targets rather than incidental ones.

Second, infrastructure-based detection is losing ground against this actor. When the last hop is a compromised device inside the US and the chain disappears after one session, inbound source reputation tells defenders very little. Visibility has to come from the management platforms themselves: authentication events, configuration changes, new administrative accounts, unexpected file writes and outbound connections from the appliance.

The vendor fixes for all named CVEs are available, and patching them is the baseline. The larger exposure is the window before a patch exists, which is exactly where Volt Typhoon has chosen to operate four times over. Silent Train is disrupted, but the tradecraft behind it has been proven and should be expected to reappear on fresh infrastructure.

RedEye Security can assess your exposure across endpoint management, SD-WAN and orchestration platforms and review whether your telemetry would surface a session like those described here. Contact our team to schedule an assessment.

Originally published on RedEye Threat Intelligence.