Volt Typhoon: the Silent Train network and zero-days on consoles

After advisory AA26-281A on the actors linked to Integrity Tech, on 28 October 2026 Black Lotus Labs, the research division of Lumen Technologies, published a report on another Chinese state-linked group, Volt Typhoon, and on the network it uses to hide its most sensitive operations: Silent Train.

It is not a stable botnet but a series of chains of compromised devices, assembled on demand, used against a few targets, cleaned up at the end of each session and constantly refreshed. Black Lotus Labs has tracked it for three years, has sent hundreds of victim notifications and has observed the exploitation of four confirmed zero-days and one likely zero-day in centralised management platforms.

How a chain is built

According to the report, as covered by several outlets, each session starts from a virtual private server outside the United States, passes through another server and through compromised SOHO routers, home devices and IoT equipment in other countries, and finally exits from a device in the United States, close to the target. The traffic thus looks local and gets past geo-blocking and IP reputation filters. On average the chains cross about four devices before reaching a US address, with up to six.

The main technical details:

• More than 27 device classes: at first mostly SOHO and IoT (TP-Link, Netgear, Intelbras, Zyxel, Ruckus, Cambium), compromised through exposed web interfaces; since early 2025 also enterprise platforms such as Fortinet, Cisco, PRTG, Mirth Connect and CyberPanel as the last hop before the victim, kept for one to three months.
• Minimal tooling: temporary SSH services, keys, configuration files and utilities already on the system (living off the land), all removed at the end of the session. Later, reverse tunnels with the open-source proxies Chisel and FRP appeared as well, alongside SSH chaining.
• Fixed roles: Intelbras modems only appear as overseas relays, Netgear Orbi devices only as US hops facing the victims; VPS providers are also kept separate by layer.
• Speed: a new chain is built in under two minutes, a sign of an at least partly automated process. Sessions last about four hours on average according to CyberScoop and Security Affairs; BleepingComputer says “typically under eight hours”.
• Some devices used as relays have no known vulnerabilities: the researchers believe the group may have used undisclosed exploits just to create one link in the chain.

Silent Train is used only for key phases: exploitation, credential theft, exfiltration and ongoing access; reconnaissance goes through other infrastructure. Each session involves one to five victims, often just one. According to Security Affairs, operators work hands-on, Monday to Friday between 9 a.m. and 10 p.m. China Standard Time.

The network appeared at the end of 2023, shortly before the FBI took down the KV-botnet, and its use grew afterwards (December 2023 according to Help Net Security, early 2024 according to CyberScoop).

The zero-days and the platforms hit

The targets are control-plane platforms: endpoint and network management, SD-WAN orchestrators. From there the attackers reach hundreds or thousands of devices and downstream customers without lateral movement, and therefore with fewer traces.

• Versa Director, CVE-2024-39717 (2024): in-memory JAR webshell to limit forensic evidence and reach downstream customers.
• N-able N-central, CVE-2025-8875 and CVE-2025-8876.
• Cisco Catalyst SD-WAN, CVE-2026-20127, CVSS 10.0: according to Security Affairs, exploitation continued even after Cisco’s disclosure in February 2026.
• VeloCloud Orchestrator, CVE-2026-16812.
• Quest KACE, likely zero-day (moderate-confidence assessment): more than 30 victims, campaign declining after Quest’s October 2025 updates; the actor stayed on the KACE server and used its administration features to harvest credentials.

After the incidents, partners found in-memory webshells, credential harvesting, abuse of native features (endpoint control, remote file transfer) and deleted or altered logs. The group also targeted technologies from Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto Networks, ServiceNow and ArcGIS, although it was not always possible to tell whether known or unknown vulnerabilities were used.

Help Net Security also reports a Cisco Talos analysis published the same day: the group UAT-11473, whose infrastructure largely overlaps with Silent Train, exploited CVE-2026-20127 on Cisco Catalyst SD-WAN controllers to install KeyDrift, a framework that maintains access and exfiltrates control-session metadata and data-plane keying material.

Impact for European and Italian companies

The victims mentioned are in the United States (Hawaii, California and Texas first): telecommunications, government bodies, defence, satellite and emergency communications, universities, MSPs and IT firms, water, energy, transport, aviation. According to the researchers, the picture is consistent with pre-positioning for a crisis in the Indo-Pacific. The sources mention no victims in Europe, but the devices used as relays are common everywhere: an Italian router or firewall can become a link in a chain against third parties. For NIS2 entities, and for MSPs, the compromise of a console that reaches customers and partners must also be assessed for notification purposes.

What to do now

1. Take off the Internet management consoles, SD-WAN orchestrators and admin portals: put them behind a VPN, a jump host or a dedicated management network.
2. Patch control-plane platforms first, starting with the CVEs listed.
3. Centralise logs on a separate system and keep them longer: attackers delete the local ones.
4. Look for unusual administrative activity on management servers and in what they do to endpoints, and review trusted connections to customers and partners.
5. Check the outbound traffic of your edge devices: SSH to unknown hosts, Chisel or FRP tunnels and unusual high ports can mean that one of your appliances is acting as a relay.
6. Do not rely on IP lists: the chain’s addresses expire within hours. Follow CISA and NCSC guidance on Volt Typhoon.

How ARXDOME helps

ARX Expose and ARX Scout show the services and admin panels exposed on the Internet, with known vulnerabilities. ARX Sentry collects firewall and network device logs and groups suspicious executions, persistence and account changes; ARX Retain keeps a copy in the long-term archive, where it cannot be modified or deleted. ARX Shield isolates a suspicious machine from the network.

Last updated: 30 October 2026