October 28, 2026 13 min to read

Volt Typhoon Silent Train: What Happened and What to Do Now

A relay network that exists for four hours at a time, aimed squarely at the tools you use to manage everything else

Most threat intelligence is built on a simple idea: attackers reuse infrastructure, so if you collect their IP addresses and domains, you can block them. Volt Typhoon has spent three years making that idea useless.

On 28 October 2026, Lumen’s Black Lotus Labs published research on a framework it calls Silent Train: chains of hijacked home routers, IoT gadgets and enterprise devices that the China state-sponsored group builds on demand, uses for a few hours against one target, wipes clean, and throws away. Lead researcher Michael Horka told CyberScoop that the number of nodes in the network at any given moment is “effectively close to zero.”

The relay network is the clever part. The targets are the part that should worry you. Silent Train was used to deliver zero-day exploits against the platforms organisations use to manage everything else: SD-WAN controllers, remote monitoring and management (RMM) tools, and network orchestrators. Compromise one of those and you don’t have to move laterally through a network. You already run it.

TL;DR / Key takeaways

• What: Black Lotus Labs exposed Silent Train, a Volt Typhoon relay framework built from compromised SOHO routers, IoT and enterprise devices. Chains are assembled in under two minutes, sessions average about four hours, and tooling is wiped afterwards.
• Targets: Telecoms, government, defence contractors, universities, IT firms and MSPs, and critical infrastructure (water, energy, transport, aviation, emergency services).
• Zero-days: Researchers confirmed zero-day campaigns against Versa Director, N-able N-central, Cisco Catalyst SD-WAN and VeloCloud Orchestrator. All four now have patches.
• Why it matters: IP blocklists barely work against infrastructure that disappears in hours. Your defence has to be on the management plane itself: exposure, patching, access control and logging.
• Do now: Confirm none of these management consoles are reachable from the internet, confirm patch levels, and hunt for administrative access from sources you don’t recognise.

Timeline

Dates are taken from Black Lotus Labs’ findings as reported by BleepingComputer, CyberScoop and Nextgov/FCW, plus vendor and CISA material. The Lumen report itself was released on 28 October and coverage is still developing.

A note on attribution: Black Lotus Labs links these zero-day campaigns to Volt Typhoon. Vendors and other researchers sometimes track the same activity under different names. Cisco Talos, for example, attributed the SD-WAN exploitation to a cluster it calls UAT-8616. For defenders this changes nothing. The flaws are real and they were exploited.

How Silent Train works

You don’t need the exact tradecraft to defend against this. You do need to see why the usual playbook fails.

Disposable relays, not a botnet

The KV Botnet was a standing network. The FBI could find it and take it down. Silent Train is different. According to BleepingComputer’s summary of the report, operators:

1. Route traffic out of VPS infrastructure outside the US.
2. Pass it through compromised devices acting as relays. Black Lotus Labs observed Intelbras modems as overseas hops and Netgear Orbi devices as US hops.
3. Get onto each relay by exploiting its exposed web management interface. They then install only what they need for chained SSH access: a temporary SSH service, keys, configuration files and built-in “live off the land” utilities.
4. Use the chain against a single high-value target.
5. Remove all tooling, keys and configuration when the session ends.

CyberScoop reports that infrastructure was assembled in under two minutes and that sessions averaged about four hours. Some lasted only minutes. Horka summed it up: “Individual chains are assembled and dismantled every day, with infrastructure continually refreshed.” He added that the framework is “fundamentally difficult to disrupt because there isn’t one network to take down.”

This was not random. “Specific device types were consistently reserved for particular positions in the chain,” Horka said. Across the campaign, Black Lotus Labs observed more than 27 device classes being exploited or abused, including products from Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto Networks, ServiceNow, TP-Link, Netgear and ArcGIS. Nextgov reports that some compromised devices had no known vulnerabilities, which suggests further undisclosed zero-days.

Why management platforms are the prize

The report’s sharpest observation is about targeting. As Nextgov quotes it: “Volt Typhoon bypasses this by targeting management platforms directly.”

Think about what an SD-WAN orchestrator, an RMM console or a network director actually is. It holds credentials and trusted connections to hundreds or thousands of downstream devices, often across many customers. An attacker with administrative control can push configuration, harvest credentials and reach customer networks. They never have to do the noisy lateral movement that EDR and network detection are built to catch. Telecom providers, Nextgov notes, were reached through enterprise IT management tools.

The 2024 Versa Director case shows the pattern. Volt Typhoon’s VersaMem web shell hooked Versa’s authentication functions to capture credentials in plaintext, which The Hacker News noted “may enable downstream compromises of client networks.”

The four confirmed zero-day targets

Black Lotus Labs also lists a suspected zero-day in Quest KACE with no CVE published yet.

Who was targeted

Black Lotus Labs describes “a sustained focus on communications, defense, government, and critical infrastructure environments of enduring strategic value.” Named sectors include telecoms, government, defence contractors, satellite providers, universities, IT firms and MSPs, and the water, energy, transportation, maritime, rail, aviation and emergency services sectors. Hawaii, California and Texas were heavily targeted, which Lumen reads as positioning around the Indo-Pacific.

Black Lotus Labs is careful to say its findings “should not be interpreted as a complete census of Volt Typhoon activity.” The visible victims are US-heavy. The technique, and the vulnerable products, are used everywhere.

Am I affected?

You should treat this as relevant if any of the following is true:

• You run on-premises Versa Director, N-able N-central, Cisco Catalyst SD-WAN Manager/Controller, VeloCloud Orchestrator or Quest KACE. This is especially urgent if the admin interface has ever been reachable from the internet or if you were slow to patch the CVEs above.
• You are an MSP, ISP, telecom or IT services provider. Your management stack is a direct route into your customers.
• You depend on an MSP or carrier that manages your network through one of these platforms. Their exposure is your exposure.
• Your branch offices or staff use consumer-grade or end-of-life routers with remote management enabled. These are the raw material for relays like Silent Train.

Signs worth investigating include administrator sessions from residential or unexpected foreign IP ranges, configuration changes nobody can account for, new SSH keys or services on appliances, and unexplained outbound connections from a management server. Because tooling is cleaned up after each session, absence of malware is not evidence of absence. Logs kept off the appliance are your best evidence.

What to do: a prioritised checklist

Immediately (next 24–48 hours)

1. Inventory your management plane. List every SD-WAN orchestrator, RMM server, network director, endpoint-management server and firewall manager you run, with its version.
2. Close internet exposure. Admin interfaces should be reachable only from a management network, VPN or jump host. For Versa Director, block external access to ports 4566 and 4570, as Black Lotus Labs recommended in 2024.
3. Verify patch levels against the table above and the vendor advisories. Upgrade any end-of-maintenance release trains.
4. If a platform was exposed and unpatched for any length of time, assume compromise. Preserve logs and filesystem timestamps first, then rotate every credential the platform stored and check managed devices. Arista explicitly warns that patching alone may not remove an existing breach.

This week

1. Ship management-plane logs off-box and extend retention. Both the researchers and AA26-113A stress centralised logging with longer retention. Attackers who clean up after four hours count on short local logs.
2. Enforce MFA and IP allow-listing for every administrative login and remote access service.
3. Hunt using the starting points below.
4. Ask your MSP and carriers which management platforms they use to reach you, how those are exposed, and when they were last patched.

Longer term

1. Replace end-of-life SOHO and IoT devices in branches and home offices, and disable their remote web management.
2. Baseline normal administrative behaviour (who, from where, when) and alert on deviations. Static IOC blocklists alone won’t keep up. WaterISAC calls this “IOC extinction.”
3. Segment management platforms like crown-jewel systems. Use dedicated admin workstations and a separate identity tier.

Detection starting points

No reliable indicator list exists for infrastructure that lives for hours, so hunt for behaviour. The queries below are templates. Rename tables and fields to match your SIEM and fill in your own management subnets.

KQL (Microsoft Sentinel): inbound connections to management consoles from outside your admin ranges

let MgmtServers ~|=| dynamic(["10.10.5.20", "10.10.5.21"]);   // your SD~|-|WAN/RMM/director IPs
let AdminRanges ~|=| dynamic(["10.99.0.0/16"]);                // jump hosts / admin VPN
CommonSecurityLog
| where TimeGenerated > ago(30d)
| where DestinationIP in (MgmtServers)
| where DestinationPort in (22, 443, 8443, 4566, 4570)
| where not(ipv4_is_in_any_range(SourceIP, AdminRanges))
| summarize Sessions ~|=| count(), FirstSeen ~|=| min(TimeGenerated), LastSeen ~|=| max(TimeGenerated)
    by SourceIP, DestinationIP, DestinationPort, DeviceAction
| order by Sessions asc   // rare sources first

Splunk: successful SSH logins to Linux-based management appliances from new sources

index~|=|linux sourcetype~|=|linux_secure host IN ("sdwan~|-|mgr*","rmm*","director*") "Accepted"
| rex "Accepted (?~|<|method>\S+) for (?~|<|user>\S+) from (?~|<|src_ip>\S+)"
| stats earliest(_time) as first_seen latest(_time) as last_seen count by host user src_ip method
| where first_seen > relative_time(now(), "~|-|7d")
| convert ctime(first_seen) ctime(last_seen)

Sigma-style rule: SSH key or daemon changes on an appliance (auditd)

title: SSH Key or Config Modified on Management Appliance
status: experimental
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: PATH
    name|contains:
      ~|-| '/.ssh/authorized_keys'
      ~|-| '/etc/ssh/sshd_config'
  condition: selection
falsepositives:
  ~|-| Planned administration via change control
level: high

For Cisco Catalyst SD-WAN, use the indicators in Cisco’s advisory, the Talos investigation guidance and the multi-agency SD-WAN threat-hunting guide linked from CISA ED 26-03. For VeloCloud, Arista recommends watching for unusual encoded or internal-service web requests, unexpected outbound HTTP/HTTPS from the orchestrator host, and unexplained configuration changes. For Versa Director, the 2024 guidance was to search the server for unexpected PNG files and to look for SOHO-device traffic to port 4566.

OffensioX perspective

Silent Train is the logical end point of a trend we have been tracking on this blog in recent weeks. Attackers no longer attack your laptops first. They go after the systems you trust to manage everything else: backup apps, identity providers, RMM tools and now SD-WAN orchestrators. They hide behind infrastructure that is gone before a blocklist can be updated. Two lessons follow. First, exposure management of the management plane is now a first-order control. A management console that answers on the internet is an invitation, whatever its patch level. Second, logging is your only memory against an adversary who cleans up. This is not just a US story. The same products run the networks of carriers, banks and MSPs across Pakistan and South Asia, and the same consumer routers sit in our branch offices and homes. Volt Typhoon’s current focus is the Indo-Pacific, but its tradecraft will be copied by anyone with a reason to. If you’d like an independent check of how exposed your management plane is, OffensioX offers penetration testing and security assessments that cover exactly these attack paths.

References

• BleepingComputer: Volt Typhoon hides zero-day attacks using ‘Silent Train’ framework
• CyberScoop: Researchers uncover Volt Typhoon’s covert, ephemeral network
• Nextgov/FCW: China’s ‘Volt Typhoon’ quietly built another hacking network following US crackdown
• The Hacker News: Chinese Volt Typhoon exploits Versa Director flaw (CVE-2024-39717)
• The Hacker News: CISA adds two N-able N-central flaws to KEV
• Tenable: CVE-2026-20127 Cisco Catalyst SD-WAN zero-day authentication bypass
• Cisco Security Advisory cisco-sa-sdwan-rpa-EHchtZk
• CISA ED 26-03: Mitigate Vulnerabilities in Cisco SD-WAN Systems
• Cisco Talos: UAT-8616 SD-WAN exploitation
• BleepingComputer: Arista patches VeloCloud Orchestrator zero-day exploited in attacks (CVE-2026-16812)
• CISA AA26-113A: Defending Against China-Nexus Covert Networks of Compromised Devices
• ExecutiveGov: CISA, UK NCSC warn of China covert cyber networks
• WaterISAC: Joint advisory on China-nexus covert networks