Lumen ties Volt Typhoon’s Silent Train network to four zero-day campaigns

Lumen’s Black Lotus Labs researchers revealed that China-linked hacking group Volt Typhoon used a covert network called Silent Train in four confirmed zero-day campaigns.

The hackers targeted platforms that manage entire networks, not just individual computers. Compromising one of these systems could give them access to telecommunications, defense, and other critical infrastructure networks.

The researchers warned:

“Systems with broad administrative reach can become high-value gateways to the entire organization and its customers.”

A disposable network built to disappear

Silent Train was designed to leave little trace. Its operators linked compromised home-office routers, connected devices, and enterprise systems to carry out attacks. Once an operation ended, they broke those connections and erased evidence of their activity. Sessions lasted about four hours on average.

Silent Train was first discovered in the latter part of 2023. Its activity increased after authorities dismantled the earlier KV-botnet of Volt Typhoon in the early part of 2024.

Black Lotus Labs sent out thousands of victim notifications over the course of three years. Among the industries affected by the hacking group are telecommunications, defense, satellite communications, energy, transportation, and the water resources sector. They showed special interest in targets that were located in Hawaii, Texas, and California.

Four campaigns, five CVEs

Silent Train’s four confirmed campaigns targeted software used to manage entire networks.

The first involved Versa Director, where CVE-2024-39717 allowed attackers with privileged access to upload malicious files. Versa disclosed the flaw in August 2024.

In 2025, attackers targeted N-able N-central through two vulnerabilities, CVE-2025-8875 and CVE-2025-8876. Both required authentication.

The 2026 campaigns involved two SD-WAN management platforms. Cisco disclosed CVE-2026-20127 on February 25. Rated 10.0, the flaw allowed attackers to gain administrative privileges without authentication. Arista disclosed another 10.0-rated vulnerability, CVE-2026-16812, affecting VeloCloud Orchestrator on July 27.

All four vendors released fixes. However, Lumen observed continued exploitation of Cisco’s vulnerability after its disclosure.

Why access is the point

Volt Typhoon’s activities go back to at least mid-2021. Microsoft publicly identified the group in May 2023, reporting intrusions into critical infrastructure networks in Guam and the continental United States.

The concern goes beyond stolen information.

In a January 2026 analysis, IISS researcher John Bruce observed:

The vast majority of the networks targeted by Volt Typhoon offered little foreign intelligence value to the Chinese government.

Bruce pointed to the group’s collection of network diagrams and operating manuals as evidence of preparations for possible disruption. Guam is particularly sensitive because its military facilities would be important in a potential conflict over Taiwan.

These remain assessments of the group’s intentions, not proof of an ordered attack.

Concentration is the exposure

The broader cybersecurity picture helps explain the danger.

Verizon’s 2026 report, covering more than 31,000 incidents, found that vulnerability exploitation had become the leading route into organizations. System intrusion accounted for 61% of confirmed breaches.

When attackers compromise software managing multiple networks, the potential damage extends beyond one organization.

The financial implications remain uncertain. The IMF has warned that interconnected financial systems face growing cyber risks. However, no market losses have been directly attributed to Silent Train.

Separately, Cryptopolitan reported another exploited VeloCloud vulnerability, CVE-2026-114625, rated 9.9 and patched on October 22. It is distinct from the flaw Lumen linked to Silent Train.