Volt Typhoon's 'Silent Train' hides attacks, including zero-days on SD-WAN and IT management platforms, behind short-lived chains of hacked routers and IoT devices

Black Lotus Labs (Lumen) reported on 2026-10-28 that China's Volt Typhoon has used a framework it calls Silent Train since late 2023. It is not a fixed botnet. Each operation gets a new chain of hacked devices that is built on demand, often in under two minutes, used for a session of roughly 4 hours (under 8), then wiped. The chain runs from overseas VPS through hacked SOHO/IoT relays (Intelbras modems abroad, Netgear Orbi inside the US) to the target. The attackers exploit exposed web interfaces, then set up temporary SSH services, keys and configs and use built-in tools. Since early 2025 they also keep hacked enterprise systems in the chain for 1 to 3 months. More than 27 device classes have been abused, including Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto Networks, ServiceNow, TP-Link, Netgear and ArcGIS. Confirmed zero-day attacks hit VeloCloud Orchestrator (CVE-2026-16812), Cisco Catalyst SD-WAN (CVE-2026-20127), N-able N-central (CVE-2025-8875, CVE-2025-8876) and Versa Director (CVE-2024-39717). Quest KACE is a suspected zero-day target (not confirmed). Hundreds of victims have been notified: telecoms, government, defense contractors, MSPs/IT firms, universities, utilities, transport, aviation, satellite and emergency services, mostly in California, Texas and Hawaii. At risk: anyone running internet-exposed management or edge platforms, and owners of SOHO routers that can be used as relays. Published IOCs: unknown (the coverage gives none).

Summary written from the sources below. Check the originals before acting.