Lumen links Volt Typhoon to attacks using Silent Train

Lumen’s Black Lotus Labs has linked a covert network named Silent Train to the China‑linked Volt Typhoon APT. In a three‑year operation, Silent Train is described as a disposable relay framework that hides exploitation of previously unknown vulnerabilities in centralised management platforms.

The firm says it tracked hundreds of victim notifications and identified exploitation campaigns that affected at least four confirmed zero‑days and one likely zero‑day, with activity beginning in November 2023 and intensifying after a second disruption of Volt Typhoon’s earlier KV‑botnet infrastructure.

Sessions typically began on a rented server outside the United States, passed through multiple compromised devices (including SOHO and IoT gear such as TP‑Link routers and Netgear Orbi devices) and culminated in a final hop to a U.S. target, enabling the attackers to mimic local traffic and evade location‑based blocks and IP reputation filters.

The trials included attacks on several enterprise and network‑management platforms, with four confirmed zero‑day campaigns against Versa Director (2024), N‑able N‑central (via CVE‑2025‑8875 and CVE‑2025‑8876), Cisco Catalyst SD‑WAN (CVE‑2026‑20127), and VeloCloud Orchestrator (CVE‑2026‑16812). Cisco’s flaw is cited as CVSS 10.0, and the group reportedly persisted with exploitation well after its disclosure in February 2026.

A potential fifth victim is Quest KACE, which was targeted before security updates in October 2025. Victims span telecoms, government, defence contractors, critical infrastructure, and large IT service providers; Hawaii, California and Texas are highlighted as recurring locations. The report notes attackers used temporary SSH access, in‑memory web shells, credential theft and log deletion, with chains lasting hours and new chains deployable within minutes.