Volt Typhoon Used Silent Train in Four Zero Day Campaigns

Volt Typhoon, a China-nexus cyber espionage actor, has been linked to a covert access network named Silent Train that has been used for zero‑day exploitation and ongoing access to victim environments. Black Lotus Labs of Lumen Technologies describes Silent Train as a rotating chain of compromised SOHO, IoT and enterprise devices, deployed on demand, with anti‑forensic and compartmentalised techniques designed to minimise detection and attribution.

The activity target areas include vulnerability exploitation, credential access and data exfiltration, with a focus on systems that can provide scalable access to downstream customers or strategic programmes. The operation has affected hundreds of entities across telecommunications, government, defence, satellite and critical infrastructure sectors, including water, energy, transport, maritime and emergency services.

Volt Typhoon has previously exploited a Versa Director file upload vulnerability (CVE-2024-39717) to deliver a bespoke VersaMem web shell. The latest findings identify four confirmed zero‑day campaigns within Silent Train, including CVE-2025-8875 and CVE-2025-8876 (N‑able N‑Central insecure deserialisation and command injection), CVE-2026-20127 (Cisco Catalyst SD‑WAN Controller authentication bypass) and CVE-2026-16812 (Arista VeloCloud Orchestrator OS command injection).

Separately, the group is suspected of exploiting a likely zero‑day in Quest KACE prior to a patch in October 2025, with the campaign estimated to have impacted more than 30 victims. Silent Train is described as a layered, multi‑hop framework using VPS staging outside the US, non‑US compromised devices as starting points, and US‑based devices as exit nodes to evade geofencing and IP reputation blocks.

Some device types show fixed roles, such as Intelbras modems as relays and Netgear Orbi or Fortinet FortiGate appliances as US intermediaries, with sessions lasting roughly four hours on average.