Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns

Lumen's Black Lotus Labs has exposed a clandestine proxy infrastructure, codenamed Silent Train, used since late 2023 by the Chinese state-sponsored group Volt Typhoon to mask four separate zero-day exploitation campaigns. The chain relies on rapidly rotating compromised SOHO routers, IoT devices and enterprise gear—spanning brands like TP-Link, Fortinet, Cisco and NETGEAR—to relay traffic from staging VPS servers through non-US devices and finally through US-based exit nodes before reaching targets, making attribution extremely difficult. Through this network the group weaponized CVE-2024-39717 in Versa Director, CVE-2025-8875 and CVE-2025-8876 in N-able N-central, CVE-2026-20127 in Cisco Catalyst SD-WAN Controller, and CVE-2026-16812 in Arista VeloCloud Orchestrator, alongside a suspected unpatched flaw in Quest KACE affecting over 30 organizations. Victims span telecoms, government, defense, satellite and critical infrastructure sectors across the US, with Hawaii, California and Texas standing out due to their military and logistics significance.