Volt Typhoon targeted enterprise control planes via ever-changing “Silent Train” relay network

Black Lotus Labs, Lumen's threat research arm, has exposed a covert infrastructure called "Silent Train" that the Chinese state-sponsored group Volt Typhoon has used for years to mask its intrusions into US critical infrastructure and enterprise networks. The network strings together hijacked SOHO/IoT devices (TP-Link, Netgear, Zyxel and others) with compromised enterprise gear from Fortinet, Cisco, PRTG and CyberPanel, routing traffic through up to six hops to evade geo-blocking and IP-reputation defenses. Through this relay chain, Volt Typhoon abused zero-day flaws including CVE-2024-39717 in Versa Director, CVE-2025-8875 and CVE-2025-8876 in N-Able N-Central, CVE-2026-20127 in Cisco Catalyst SD-WAN, and CVE-2026-16812 in VeloCloud Orchestrator, along with a suspected unknown bug in Quest KACE, to reach control-plane systems directly without needing lateral movement. Separately, Cisco Talos linked a related actor, UAT-11473, to exploitation of CVE-2026-20127 for deploying the KeyDrift malware against Cisco SD-WAN Catalyst Controllers, underscoring how this infrastructure keeps enabling long-term espionage against telecom, defense, government and critical-infrastructure targets concentrated in states like Hawaii, California and Texas.