Volt Typhoon zero-days via Silent Train network, Black Lotus Labs reports

What happened

According to The Hacker News, Lumen Technologies Black Lotus Labs reports that the China-nexus espionage group Volt Typhoon used a covert access network called Silent Train for zero-day exploitation and strategic access. Black Lotus Labs says the network is now disrupted. The attribution and the details below come from Black Lotus Labs’ report as summarised by The Hacker News. No other outlet or official advisory in the provided sources confirms them independently.

Black Lotus Labs says Silent Train was first identified in late 2023 and uses rotating chains of compromised SOHO, IoT and enterprise devices. Its operators used anti-forensic techniques and cleaned up after each operation The Hacker News.

The researchers say the network was used in four confirmed zero-day campaigns The Hacker News:

• CVE-2024-39717: a file upload flaw in Versa Director. The report links it to a web shell called VersaMem.
• CVE-2025-8875 and CVE-2025-8876: insecure deserialization and command injection flaws in N-able N-central.
• CVE-2026-20127: an authentication bypass in Cisco Catalyst SD-WAN Controller.
• CVE-2026-16812: an OS command injection flaw in Arista VeloCloud Orchestrator.

Black Lotus Labs also says Volt Typhoon is suspected of exploiting a likely zero-day in Quest KACE before it was patched in October 2025. The researchers estimate that campaign affected more than 30 victims. A CVE for the Quest KACE issue is not confirmed in the source The Hacker News.

The report describes the network’s structure and the sectors it targeted The Hacker News:

• Victims: hundreds of victims across telecommunications, government, defense contractors, satellite communications, universities, IT firms and critical infrastructure.
• How sessions were built: sessions started from VPS infrastructure outside the U.S. They passed through compromised non-U.S. SOHO and IoT devices, then exited through compromised U.S. devices.
• Enrolled devices: at least 27 device classes were enrolled. Named brands include TP-Link, Intelbras, Ruckus Wireless, SATO, NETGEAR, Zyxel, Cambium, Fortinet, Cisco, PRTG, Mirth Connect and CyberPanel.
• Tooling: operators deployed temporary SSH services, keys and configuration files, and later used reverse tunnels built with Chisel and FRP.

The victims have not been named. Fixed version numbers for the CVEs are not confirmed in the source.

Am I affected?

• You may be exposed if you run any of the products named in the CVE list above, or Quest KACE, and have not applied the vendor fixes. The affected and fixed versions are not confirmed in the source, so check each vendor’s advisory.
• Your SOHO, IoT or enterprise edge devices could have been used as relays if their web interfaces are exposed to the internet. Black Lotus Labs says the operators gained access through exposed web interfaces on such devices The Hacker News. The report says Netgear Orbi and Fortinet FortiGate devices were used as U.S. exit points and Intelbras modems as relay nodes.
• Whether any specific organisation was targeted is not confirmed in the source.

What to do now

1. Look up each CVE listed above on NVD and in the vendor’s advisory. Confirm the fixes are installed on N-central, Catalyst SD-WAN Controller, VeloCloud Orchestrator and Versa Director, and that Quest KACE has the October 2025 patch.
2. Review those management and control plane systems for unexpected logins, new accounts or web shells. These are the platform types the report says were targeted.
3. Limit internet exposure of web management interfaces on routers, modems, IoT devices and firewalls.
4. Check edge and SOHO devices for unexpected SSH services, unknown SSH keys or configuration files, and Chisel or FRP binaries. The report names these as Silent Train tooling, though it also says operators removed artifacts after each session.
5. Watch for updates from Black Lotus Labs and the affected vendors. Indicators of compromise are not confirmed in the source.

Sources

• The Hacker News: Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns
• NVD: CVE-2024-39717
• NVD: CVE-2025-8875
• NVD: CVE-2025-8876
• NVD: CVE-2026-20127
• NVD: CVE-2026-16812