Lumen details Volt Typhoon’s Silent Train zero-day attacks on U.S. critical infrastructure

Lumen’s Black Lotus Labs detailed how China-linked Volt Typhoon used its Silent Train framework to exploit zero-day flaws against U.S. critical infrastructure and strategic targets.

Black Lotus Labs first identified Silent Train in November 2023 and has tracked it for more than three years. Volt Typhoon reserves the framework for exploitation and post-exploitation, distinct from the operational relay box and ad-hoc infrastructure Volt Typhoon used for reconnaissance and target development.

Black Lotus Labs said its monitoring uncovered four confirmed zero-day campaigns and one likely zero-day campaign, along with hundreds of victim notifications and investigations. Lumen noted that every zero-day campaign through Silent Train targeted management or control-plane platforms.

The confirmed flaws hit Versa Director through CVE-2024-39717, N-able N-central using CVE-2025-8875 and CVE-2025-8876, Cisco Catalyst SD-WAN using CVE-2026-20127, and VeloCloud Orchestrator using CVE-2026-16812. A likely campaign hit Quest KACE, affected more than 30 victims, and faded after Quest’s October 2025 security updates. Black Lotus Labs assessed with moderate confidence that Volt Typhoon exploited a previously undisclosed flaw in Quest KACE.

Cisco Talos said UAT-11473, whose infrastructure overlaps with Silent Train, used CVE-2026-20127 to install KeyDrift on Cisco SD-WAN Catalyst Controller instances. Talos does not say UAT-11473 and Volt Typhoon are the same group. The flaw carries a CVSS score of 10. Disclosed in February 2026, it lets remote attackers without credentials bypass peering authentication on SD-WAN controller components to gain administrative rights.

Lumen said the group was using CVE-2026-20127 by late 2025 and kept using it after Cisco’s disclosure. Cisco warns that access obtained through the flaw lets attackers alter the SD-WAN network’s configuration.

Victims included telecommunications firms, government bodies, managed service providers, universities with military links, critical infrastructure operators, defense contractors, satellite and mission-critical communications providers, IT firms, educational institutes, and organizations in the maritime and rail sectors. Hawaii, California and Texas were the most heavily targeted states, reflecting enduring interest in communications, logistics, defense and critical systems for U.S. Indo-Pacific operations.

Silent Train routes traffic through disposable virtual private servers outside the United States, then through compromised non-U.S. devices, then through compromised U.S.-based devices as domestic exit points. Researchers saw more than 27 categories of compromised hardware, such as TP-Link routers, Netgear Orbi devices, Fortinet appliances and Intelbras modems.

The group assigned fixed roles to device types and did not change them during the three-year observation. Intelbras modems served only as overseas relays, while Netgear Orbi devices served as U.S.-based hops that contacted victims. Fortinet FortiGate appliances served as U.S.-based intermediary and exit points responsible for interacting with victims.

Operators exploited exposed web interfaces on relay devices, then deployed SSH services, keys, configuration files and living-off-the-land tools. Sessions typically lasted about four hours, with some running only minutes, and operators could build chains in less than two minutes. When each session ended, they cleared all traces and took the chain apart.

Enterprise platforms remained active for one to three months and backed intrusions as Silent Train turned hybrid by early 2025. Each session targeted one to five victims, most often one organization, and targets offered scalable access to downstream customers plus sensitive networks or strategic programs.

Operators were sometimes as many as six hops away from victims. As the framework matured, operators added reverse-tunnel variants alongside traditional SSH chaining, including reverse tunnels through open-source proxies such as Chisel and FRP. Silent Train ran traditional SSH chains and reverse-tunnel chains at once, plus semi-persistent hop chains and hybrid variants in parallel.

Sessions occurred Monday through Friday from 09:00 to 22:00 China Standard Time, with little overnight or weekend activity. Activity fell for weeks during the Chinese New Year.

Partner analysis uncovered in-memory webshells, credential theft and misuse of built-in functions including endpoint control and remote file transfers. In some cases, the actors deleted or changed logs and other evidence.

Continuous monitoring let Black Lotus Labs see exploitation frequently ahead of public disclosures, vendor alerts and incident response. Telemetry from the global IP backbone revealed structured workflows and deliberate compartmentalization alongside rapid infrastructure rotation that remained consistent despite frequent changes.

Volt Typhoon started building Silent Train before the KV botnet’s takedown in December 2023 and stepped up use afterward. Black Lotus Labs researchers said deployment was partly driven by the FBI’s disruption of KV-Botnet, a botnet used to evade detection while attacking U.S. critical infrastructure. CyberScoop reported that Volt Typhoon depended more on Silent Train after U.S. law enforcement disrupted the KV Botnet in early 2024. Silent Train activity surged after the KV botnet’s second disruption in late January 2024.

Black Lotus Labs worked with U.S. agencies to investigate KV-botnet, alert victims and take down thousands of compromised routers in late 2023. The late-2023 disruption dealt a major blow to Volt Typhoon’s infrastructure, though the group had already begun developing a more elusive obfuscation framework.

Earlier, the group used a file upload flaw in Versa Director as a zero-day tracked as CVE-2024-39717 to deliver a custom web shell named VersaMem, which harvested credentials and enabled access to downstream customers. In mid-2024, Black Lotus Labs publicly documented the Versa Director exploitation; the group then used an in-memory JAR webshell.

A compromise of N-able N-Central lets attackers control many downstream assets such as customer environments, potentially hundreds or thousands. Volt Typhoon targeted trusted peering mechanisms that link SD-WAN devices and control infrastructure, using Cisco Catalyst SD-WAN as a strategic access point. Cisco warns that access obtained through CVE-2026-20127 can be leveraged to alter the SD-WAN network’s configuration.

KeyDrift’s PolyFlame module works as a backdoor and can pass commands to other hosts, serving as an intermediate command-and-control node. Its LittleFilch module collects keying material that may include keys protecting data-plane traffic.

Volt Typhoon targeted edge, identity, network and enterprise management products including Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto, ServiceNow and ArcGIS. The group focuses on management platforms because they already provide visibility, access and administrative functions, letting it gain broad reach without lateral movement and with fewer host interactions, authentication events and forensic artifacts.

Volt Typhoon, also known as Bronze Silhouette, Insidious Taurus, UNC3236, Vanguard Panda and Voltzite, is a China-linked state-sponsored group active since at least 2021. The group targets critical infrastructure networks such as communications, energy, transportation, and water and wastewater systems. CISA has warned that Volt Typhoon seeks to establish access to U.S. critical infrastructure for possible disruption during a future crisis or conflict.

Mike Horka of Black Lotus Labs told journalist Kim Zetter that the hackers took documents about military operations and network structures. Horka believes the Volt Typhoon activity combines pre-positioning and espionage. Because Silent Train is ephemeral, lead researcher Michael Horka said the group’s observations should not be seen as a full count of Volt Typhoon activity.

Horka said Silent Train cannot be disrupted because no single network exists to remove, and current infrastructure will look entirely different tomorrow. Silent Train operated like an organized inventory of capabilities rather than randomly compromised devices, and the number of nodes at any moment was effectively close to zero because infrastructure was continually refreshed, Michael Horka said.

Black Lotus Labs advises organizations to cut internet-facing exposure, patch management platforms quickly, tighten access controls, review downstream permissions, and keep security logs and telemetry. Teams should block direct paths to administrative interfaces using VPNs, access control rules, jump hosts or separate management networks.

Teams should review how their systems, services and trust relationships might let attackers reach wider client, partner, government and critical-infrastructure environments. Firms should follow CISA and NCSC guidance to reduce Volt Typhoon activity and protect against China-nexus covert networks built from compromised devices.