{"id":"CMP-202610-volt-typhoon-s-silent-train-hides-attacks-including-zero-day","kind":"campaign","aliases":[],"related":["CVE-2026-16812","CVE-2026-20127","CVE-2025-8875","CVE-2025-8876","CVE-2024-39717"],"title":"Volt Typhoon's 'Silent Train' hides attacks, including zero-days on SD-WAN and IT management platforms, behind short-lived chains of hacked routers and IoT devices","description":null,"summary":"Black Lotus Labs (Lumen) reported on 2026-10-28 that China's Volt Typhoon has used a framework it calls Silent Train since late 2023. It is not a fixed botnet. Each operation gets a new chain of hacked devices that is built on demand, often in under two minutes, used for a session of roughly 4 hours (under 8), then wiped. The chain runs from overseas VPS through hacked SOHO/IoT relays (Intelbras modems abroad, Netgear Orbi inside the US) to the target. The attackers exploit exposed web interfaces, then set up temporary SSH services, keys and configs and use built-in tools. Since early 2025 they also keep hacked enterprise systems in the chain for 1 to 3 months. More than 27 device classes have been abused, including Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto Networks, ServiceNow, TP-Link, Netgear and ArcGIS. Confirmed zero-day attacks hit VeloCloud Orchestrator (CVE-2026-16812), Cisco Catalyst SD-WAN (CVE-2026-20127), N-able N-central (CVE-2025-8875, CVE-2025-8876) and Versa Director (CVE-2024-39717). Quest KACE is a suspected zero-day target (not confirmed). Hundreds of victims have been notified: telecoms, government, defense contractors, MSPs/IT firms, universities, utilities, transport, aviation, satellite and emergency services, mostly in California, Texas and Hawaii. At risk: anyone running internet-exposed management or edge platforms, and owners of SOHO routers that can be used as relays. Published IOCs: unknown (the coverage gives none).","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-10-28T16:36:46+00:00","products":[{"name":"VeloCloud Orchestrator","fixed":[],"affected":"unknown","ecosystem":"vendor"},{"name":"Cisco Catalyst SD-WAN","fixed":[],"affected":"unknown","ecosystem":"vendor"},{"name":"N-able N-central","fixed":[],"affected":"unknown","ecosystem":"vendor"},{"name":"Versa Director","fixed":[],"affected":"unknown","ecosystem":"vendor"},{"name":"Quest KACE","fixed":[],"affected":"unknown (suspected)","ecosystem":"vendor"},{"name":"Netgear Orbi","fixed":[],"affected":"unknown","ecosystem":"vendor"},{"name":"Intelbras modems","fixed":[],"affected":"unknown","ecosystem":"vendor"}],"ecosystems":[],"tags":["campaign","china","early-warning","edge-devices","soho-routers","volt-typhoon"],"not_affected_if":[],"how_to_check":"- List internet-exposed admin interfaces for VeloCloud Orchestrator, Cisco Catalyst SD-WAN Manager, N-able N-central, Versa Director and Quest KACE, plus edge devices from Fortinet, Ivanti, F5, Check Point, Palo Alto Networks and ManageEngine. Confirm the CVEs listed are patched.\n- On routers, IoT and edge devices (including Netgear Orbi and Intelbras), look for SSH services, authorized keys or config files you did not create, especially ones that appear and disappear within hours.\n- In management-platform logs, look for admin logins or config changes from SOHO/residential IP ranges, short sessions during China Standard Time working hours, and new trust links to customer or partner networks.\n- Specific IPs, domains or hashes: unknown in public coverage so far.","fix":"- Take management and admin interfaces off the internet. Allow them only from trusted internal IPs or a jump host.\n- Patch VeloCloud Orchestrator, Cisco Catalyst SD-WAN, N-able N-central and Versa Director for the CVEs listed, and patch other edge devices quickly.\n- Replace end-of-life SOHO routers, turn off remote web admin on them, and update their firmware.\n- Centralise logs from edge and management systems and keep them longer than 8 hours of session life would need (aim for months). Alert on unusual admin activity.\n- MSPs: review trusted connections into customer and partner networks.\n- Follow CISA and NCSC guidance on Volt Typhoon.","status":"open","published_at":"2026-10-28T00:00:00+00:00","first_seen_at":"2026-10-28T16:36:46+00:00","triaged_at":"2026-10-28T16:36:46+00:00","updated_at":"2026-10-28T16:36:46+00:00","category":"infrastructure","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-10':90B '-16812':240B '-20127':248B '-2024':265B '-2025':256B,259B '-2026':239B,247B '-202610':32A '-28':91B '-39717':266B '-8875':257B '-8876':260B '1':200B '2023':107B '2025':189B '2026':89B '27':206B '3':202B '4':139B '8':142B 'abl':251B 'able':57A 'abroad':157B 'abus':211B 'also':191B 'alto':221B 'anyon':306B 'arcgi':229B 'attack':7A,167B,234B 'attacks':40A 'aviat':293B 'behind':20A 'black':83B 'botnet':113B 'built':125B,184B 'built-in':183B 'california':300B 'call':102B 'campaign':69B 'catalyst':51A,242B 'central':60A,254B 'chain':24A,119B,146B,198B 'check':218B 'china':70B,93B 'cisco':50A,214B,241B 'class':208B 'cmp':31A 'config':180B 'confirm':230B,277B 'contractor':287B 'coverag':330B 'cve':238B,246B,255B,258B,264B 'day':11A,43A,233B,274B 'defens':286B 'demand':127B 'devic':30A,76B,122B,207B 'director':62A,263B 'earli':72B,188B 'early-warn':71B 'edg':75B,313B 'edge-devic':74B 'emerg':296B 'enterpris':194B 'exploit':168B 'expos':169B,310B 'f5':217B 'firm':289B 'fix':112B 'fortinet':213B 'framework':100B 'get':116B 'give':331B 'govern':285B 'hack':26A,121B,152B,193B 'hawaii':303B 'hide':6A 'hides':39A 'hit':235B 'hour':140B 'hundr':278B 'includ':8A,212B 'including':41A 'insid':160B 'intelbra':155B 'intelbras':67A 'interfac':171B 'internet':309B 'internet-expos':308B 'ioc':327B 'iot':29A 'ivanti':216B 'kace':64A,268B 'keep':192B 'key':178B 'lab':85B 'late':106B 'link':226B 'live':23A 'lotus':84B 'lumen':86B 'manag':18A,311B 'manageengin':215B 'minut':132B 'modem':156B 'modems':68A 'month':203B 'most':298B 'msps/it':288B 'n':56A,59A,250B,253B 'n-abl':249B 'n-able':55A 'n-central':58A,252B 'netgear':65A,158B,227B 'network':222B 'new':118B 'none':332B 'notifi':283B 'often':128B 'oper':115B 'orbi':66A,159B 'orchestr':237B 'orchestrator':49A 'oversea':149B 'owner':316B 'palo':220B 'platform':19A,314B 'point':219B 'publish':326B 'quest':63A,267B 'relay':154B,325B 'report':87B 'risk':305B 'rough':138B 'router':27A,79B,319B 'run':147B,307B 's':36A 'satellit':294B 'sd':14A,53A,244B 'sd-wan':13A,52A,243B 'servic':177B,297B 'servicenow':223B 'session':136B 'set':173B 'short':22A 'short-liv':21A 'silent':4A,37A,44A,103B 'sinc':105B,187B 'soho':78B,318B 'soho-rout':77B 'soho/iot':153B 'ssh':176B 'suspect':271B 'system':195B 'target':165B,275B 'telecom':284B 'temporari':175B 'texa':301B 'tool':186B 'tp':225B 'tp-link':224B 'train':5A,38A,45A,104B 'transport':292B 'two':131B 'typhoon':2A,35A,47A,82B,96B 'univers':290B 'unknown':328B 'us':162B 'use':98B,133B,182B,323B 'util':291B 'velocloud':48A,236B 'versa':61A,262B 'victim':280B 'volt':1A,34A,46A,81B,95B 'volt-typhoon':80B 'volt-typhoon-s-silent-train-hides-attacks-including-zero-day':33A 'vps':150B 'wan':15A,54A,245B 'warn':73B 'web':170B 'wipe':144B 'zero':10A,42A,232B,273B 'zero-day':9A,231B,272B","nicknames":["Silent Train","Volt Typhoon"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202610-volt-typhoon-s-silent-train-hides-attacks-including-zero-day","url":null,"severity":null,"published_at":"2026-10-28T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-28T16:36:46+00:00","fetched_at":"2026-10-28T16:36:46+00:00","note":null}],"documents":[{"id":11319,"url":"https://www.bleepingcomputer.com/news/security/volt-typhoon-hides-zero-day-attacks-using-silent-train-framework/","title":"BleepingComputer: Volt Typhoon hides zero-day attacks using 'Silent Train' framework","kind":"blog","source":"blog","text":"Volt Typhoon hides zero-day attacks using 'Silent Train' framework\n\nChinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems. [...]","published_at":"2026-10-28T16:00:00+00:00","relation":"describes","confidence":null,"note":null},{"id":11160,"url":"https://x.com/BleepinComputer/status/2115473735079575627","title":"@BleepinComputer: Volt Typhoon hides zero-day attacks using 'Silent Train' framework\nhttps://t.co/","kind":"post","source":"x","text":"Volt Typhoon hides zero-day attacks using 'Silent Train' framework\nhttps://t.co/lElkr0HCOb\n\nhttps://t.co/lElkr0HCOb\n\nlikes 34 reposts 7","published_at":"2026-10-28T16:00:16+00:00","relation":"describes","confidence":null,"note":null},{"id":11384,"url":"https://cyberscoop.com/volt-typhoon-silent-train-covert-ephemeral-network-black-lotus-labs/","title":"Researchers uncover Volt Typhoon's covert, ephemeral network (Silent Train, Black Lotus Labs)","kind":"blog","source":"analyst","text":"CyberScoop on Black Lotus Labs (Lumen) report, 2026-10-28. Silent Train: Volt Typhoon covert relay chains of compromised SOHO routers, IoT and enterprise devices, rotated since late 2023; chains rebuilt in under 2 minutes, sessions ~4 hours, cleaned up after. Hundreds of victims notified (telecom, government, defense, universities, IT, water, energy, transport, maritime, rail, aviation, emergency services). 27+ device classes abused; compromised vendors include Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto Networks, ServiceNow, TP-Link, Netgear, ArcGIS. Confirmed zero-day campaigns against Versa Director, N-able N-central, Cisco Catalyst SD-WAN, VeloCloud Orchestrator. Heavier use after the KV Botnet disruption in early 2024.","published_at":"2026-10-28T00:00:00+00:00","relation":"describes","confidence":null,"note":null},{"id":11787,"url":"https://x.com/TheHackersNews/status/2115506858517815431","title":"@TheHackersNews: 🚨 Volt Typhoon used a covert network of hijacked devices in 4 confirmed zero-day","kind":"post","source":"x","text":"🚨 Volt Typhoon used a covert network of hijacked devices in 4 confirmed zero-day exploitation campaigns.\n\nDubbed \"Silent Train,\" it concealed attacks on enterprise management systems and supported strategic access to U.S. networks.\n\nRead: https://t.co/MoZ7xs7F6F\n\nlikes 13 reposts 5","published_at":"2026-10-28T18:11:53+00:00","relation":"discussion","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}