--- id: "CMP-202610-volt-typhoon-s-silent-train-hides-attacks-including-zero-day" kind: "campaign" aliases: [] title: "Volt Typhoon's 'Silent Train' hides attacks, including zero-days on SD-WAN and IT management platforms, behind short-lived chains of hacked routers and IoT devices" severity: "high" cvss: null epss: null exploited: true status: "open" category: "infrastructure" products: [{"name": "VeloCloud Orchestrator", "fixed": [], "affected": "unknown", "ecosystem": "vendor"}, {"name": "Cisco Catalyst SD-WAN", "fixed": [], "affected": "unknown", "ecosystem": "vendor"}, {"name": "N-able N-central", "fixed": [], "affected": "unknown", "ecosystem": "vendor"}, {"name": "Versa Director", "fixed": [], "affected": "unknown", "ecosystem": "vendor"}, {"name": "Quest KACE", "fixed": [], "affected": "unknown (suspected)", "ecosystem": "vendor"}, {"name": "Netgear Orbi", "fixed": [], "affected": "unknown", "ecosystem": "vendor"}, {"name": "Intelbras modems", "fixed": [], "affected": "unknown", "ecosystem": "vendor"}] ecosystems: [] tags: ["campaign", "china", "early-warning", "edge-devices", "soho-routers", "volt-typhoon"] not_affected_if: [] published_at: "2026-10-28T00:00:00+00:00" first_seen_at: "2026-10-28T16:36:46+00:00" updated_at: "2026-10-28T16:36:46+00:00" sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-28T16:36:46+00:00"}] --- # Volt Typhoon's 'Silent Train' hides attacks, including zero-days on SD-WAN and IT management platforms, behind short-lived chains of hacked routers and IoT devices Black Lotus Labs (Lumen) reported on 2026-10-28 that China's Volt Typhoon has used a framework it calls Silent Train since late 2023. It is not a fixed botnet. Each operation gets a new chain of hacked devices that is built on demand, often in under two minutes, used for a session of roughly 4 hours (under 8), then wiped. The chain runs from overseas VPS through hacked SOHO/IoT relays (Intelbras modems abroad, Netgear Orbi inside the US) to the target. The attackers exploit exposed web interfaces, then set up temporary SSH services, keys and configs and use built-in tools. Since early 2025 they also keep hacked enterprise systems in the chain for 1 to 3 months. More than 27 device classes have been abused, including Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto Networks, ServiceNow, TP-Link, Netgear and ArcGIS. Confirmed zero-day attacks hit VeloCloud Orchestrator (CVE-2026-16812), Cisco Catalyst SD-WAN (CVE-2026-20127), N-able N-central (CVE-2025-8875, CVE-2025-8876) and Versa Director (CVE-2024-39717). Quest KACE is a suspected zero-day target (not confirmed). Hundreds of victims have been notified: telecoms, government, defense contractors, MSPs/IT firms, universities, utilities, transport, aviation, satellite and emergency services, mostly in California, Texas and Hawaii. At risk: anyone running internet-exposed management or edge platforms, and owners of SOHO routers that can be used as relays. Published IOCs: unknown (the coverage gives none). _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:VeloCloud Orchestrator affected unknown fixed ? - vendor:Cisco Catalyst SD-WAN affected unknown fixed ? - vendor:N-able N-central affected unknown fixed ? - vendor:Versa Director affected unknown fixed ? - vendor:Quest KACE affected unknown (suspected) fixed ? - vendor:Netgear Orbi affected unknown fixed ? - vendor:Intelbras modems affected unknown fixed ? ## How to check - List internet-exposed admin interfaces for VeloCloud Orchestrator, Cisco Catalyst SD-WAN Manager, N-able N-central, Versa Director and Quest KACE, plus edge devices from Fortinet, Ivanti, F5, Check Point, Palo Alto Networks and ManageEngine. Confirm the CVEs listed are patched. - On routers, IoT and edge devices (including Netgear Orbi and Intelbras), look for SSH services, authorized keys or config files you did not create, especially ones that appear and disappear within hours. - In management-platform logs, look for admin logins or config changes from SOHO/residential IP ranges, short sessions during China Standard Time working hours, and new trust links to customer or partner networks. - Specific IPs, domains or hashes: unknown in public coverage so far. ## Fix - Take management and admin interfaces off the internet. Allow them only from trusted internal IPs or a jump host. - Patch VeloCloud Orchestrator, Cisco Catalyst SD-WAN, N-able N-central and Versa Director for the CVEs listed, and patch other edge devices quickly. - Replace end-of-life SOHO routers, turn off remote web admin on them, and update their firmware. - Centralise logs from edge and management systems and keep them longer than 8 hours of session life would need (aim for months). Alert on unusual admin activity. - MSPs: review trusted connections into customer and partner networks. - Follow CISA and NCSC guidance on Volt Typhoon. ## Timeline - 2026-10-28T16:36:46+00:00 analyst ## Documents - [describes] BleepingComputer: Volt Typhoon hides zero-day attacks using 'Silent Train' framework https://www.bleepingcomputer.com/news/security/volt-typhoon-hides-zero-day-attacks-using-silent-train-framework/ - [describes] @BleepinComputer: Volt Typhoon hides zero-day attacks using 'Silent Train' framework https://t.co/ https://x.com/BleepinComputer/status/2115473735079575627 - [describes] Researchers uncover Volt Typhoon's covert, ephemeral network (Silent Train, Black Lotus Labs) https://cyberscoop.com/volt-typhoon-silent-train-covert-ephemeral-network-black-lotus-labs/ - [discussion] @TheHackersNews: 🚨 Volt Typhoon used a covert network of hijacked devices in 4 confirmed zero-day https://x.com/TheHackersNews/status/2115506858517815431 --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_