Volt Typhoon hides zero-day attacks using 'Silent Train' framework

Black Lotus Labs, Lumen's research arm, has spent three years tracking a covert operational system used by the Chinese state-backed group Volt Typhoon, which it calls "Silent Train." This infrastructure chains together compromised consumer and enterprise devices—including Intelbras modems abroad and Netgear Orbi routers inside the US—to relay and disguise the origin of attacks, which are then wiped clean within hours to avoid detection. Through this framework, the group exploited at least four zero-day flaws: CVE-2026-16812 in VeloCloud Orchestrator, CVE-2026-20127 in Cisco Catalyst SD-WAN, CVE-2025-8875 and CVE-2025-8876 in N-able N-central, and CVE-2024-39717 in Versa Director, along with a suspected unpatched issue in Quest KACE. Victims span telecoms, government, defense, education, utilities, satellite providers, MSPs, and transportation, with notable concentration in California, Texas, and Hawaii, pointing to Indo-Pacific strategic interests. Researchers urge organizations to lock down management interfaces, patch quickly, and watch for unusual admin activity given the group's history of pre-positioning for future disruption.