Threats · 3h ago
Lumen Technologies’ Black Lotus Labs tied Volt Typhoon’s Silent Train network to four confirmed zero-day campaigns against management and SD-WAN systems, estimated to have affected more than 30 victims. The flaws were in Versa Director, N-able N-central, Cisco Catalyst SD-WAN Controller, and Arista VeloCloud Orchestrator; Black Lotus Labs has identified hundreds of victims across critical sectors.
Silent Train links compromised routers, internet-of-things (IoT) devices, and enterprise systems into a temporary relay, then replaces the chain with different devices in under two minutes. That makes snapshots of suspicious IP addresses stale quickly. Volt Typhoon used the shifting route to exploit management flaws and gain deeper access; Black Lotus Labs also observed extensive cleanup that could obscure what remained inside a victim.
If a managed service provider or operator relies on these control planes to administer customer or strategic networks, compromise can extend beyond the appliance into the environments it manages. Disrupting the relay alone does not establish that this downstream access was removed.
Known exploited · CISA KEV
CVSS 10 CRITICAL: a vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco… EPSS 89% (100th percentile).
CISA federal remediation date Feb 27 · date passed
Known exploited · CISA KEV
CVSS 7.2 HIGH: the Versa Director GUI provides an option to customize the look and feel of the user interface. EPSS 4% (90th percentile).
CISA federal remediation date Sep 13 · date passed
Known exploited · CISA KEV
CVSS 8.8 HIGH: improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central… EPSS 3% (88th percentile).
CISA federal remediation date Aug 20 · date passed
Known exploited · CISA KEV
CVSS 7.8 HIGH: deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects… EPSS 2% (79th percentile).
CISA federal remediation date Aug 20 · date passed
Known exploited · CISA KEV
CVSS 10 CRITICAL: veloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host.
CISA federal remediation date Jul 30 · date passed
3 sources covering this story
Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns
Volt Typhoon used the disrupted Silent Train network for four zero-day campaigns targeting enterprise management systems and strategic networks.
Volt Typhoon hides zero-day attacks using 'Silent Train' framework
Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems.
Researchers uncover Volt Typhoon’s covert, ephemeral network
The China-linked threat group has used the “Silent Train” framework, built on a series of rapidly rotating compromised devices, to infiltrate hundreds of critical infrastructure networks.
Part of the PlainSec briefing for 2026-10-28