Skip to content
Hacker Posts

Volt Typhoon ran four zero-days through 'Silent Train' relays

Black Lotus Labs says Volt Typhoon chained at least four zero-days — Versa, VeloCloud, Cisco SD-WAN, N-able — through Silent Train, a self-rebuilding relay network of compromised devices.

Published 3 min read
threat-intelvolt-typhoonchinazero-day

Volt Typhoon has spent three years routing intrusions through a continuously rebuilt mesh of compromised devices that its trackers now call Silent Train, and used it to stage at least four zero-day campaigns against edge and management infrastructure. The research comes from Black Lotus Labs, the threat-intelligence arm of Lumen, published 28 October 2026. If you run the products named below, treat this as confirmation that a Chinese state-sponsored operator was exploiting them before a patch existed.

What Silent Train is

Silent Train is not a static botnet. It is an operational framework: Volt Typhoon routes activity through VPS infrastructure outside the US, then through compromised relays — Black Lotus Labs observed Intelbras modems used as overseas hops and Netgear Orbi devices as US-side relays — assembling and tearing down chains per operation. Sessions typically end within eight hours, after which the operator removes its tooling. Since early 2025 the framework has been hybrid: disposable relays plus compromised enterprise systems held for one to three months.

Black Lotus Labs frames the shift as a direct response to the FBI's early-2024 disruption of the KV-Botnet. Deny an actor its infrastructure and it builds one that is harder to measure, because what you can see at any moment is never the whole picture.

The zero-days

Black Lotus Labs says Volt Typhoon exploited at least four zero-days across the campaigns it observed:

The researchers also flag a suspected zero-day against Quest KACE but say it is not confirmed — we are leaving it unnamed rather than attach a CVE to it.

Who and what got hit

Silent Train has drawn on more than 27 device classes, with compromised products spanning Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto Networks, ServiceNow, TP-Link, Netgear and ArcGIS. Victims notified so far include telecom providers, government bodies, defense contractors, universities and operators across water, energy, transportation, maritime, rail, aviation and emergency services. Black Lotus Labs assesses the operations ran on China Standard Time and were reserved for high-value, hands-on targets.

Attribution is Black Lotus Labs' own: it calls Volt Typhoon a Chinese state-sponsored group. No court filing accompanies this report, so treat the label as the researchers' assessment.

Action checklist

  1. Patch the named zero-days now if you run Versa Director, VeloCloud Orchestrator, Cisco Catalyst SD-WAN or N-able N-central — these were exploited pre-disclosure.
  2. Pull the IOCs from the Lumen report; neither the report summary nor secondary coverage embeds hashes or IPs in reusable form.
  3. Put SOHO routers and IoT devices in your threat model as relay candidates, not just as endpoints.
  4. Prioritize review of centralized management platforms (RMM, IAM, SD-WAN orchestrators) — Silent Train repeatedly targets the control plane.
  5. Detect on behavior and access patterns, not static indicators: the infrastructure refreshes continuously, so blocklists age out in hours.

Context

This is the same playbook, iterated. We covered China-nexus edge-device compromise when Flax Typhoon's infrastructure landed on CISA's KEV, and the SD-WAN orchestrator keeps recurring as a target of choice. The through-line: when takedowns strip an actor's botnet, it does not retreat — it rebuilds on something you cannot enumerate.

Related stories