Volt Typhoon Silent Train: Lumen links relay network to Cisco SD-WAN CVE-2026-20127, VeloCloud CVE-2026-16812 zero-days

Lumen's Black Lotus Labs published a report on 28 October 2026 describing "Silent Train", a relay network that it says the Chinese state-sponsored group Volt Typhoon has used for about three years to reach targets through short-lived chains of hacked routers, IoT devices and enterprise servers. The report ties the network to four confirmed and one likely zero-day campaign against management platforms: Quest KACE, Versa Director, N-able N-central, Cisco Catalyst SD-WAN and Arista's VeloCloud Orchestrator. If you run any of those, or any internet-facing admin console, the report is a to-do list.

Key points

• Black Lotus Labs (Lumen) says Silent Train builds a new relay chain in under two minutes and tears it down after use, so there is no single network to block or take down.
• The report links the network to zero-day exploitation of Cisco Catalyst SD-WAN (CVE-2026-20127), VeloCloud Orchestrator (CVE-2026-16812), N-able N-central (CVE-2025-8875 and CVE-2025-8876) and Versa Director, plus a suspected zero-day in Quest KACE.
• More than 27 device classes were used as relays, including TP-Link, Netgear Orbi, Intelbras, Zyxel, Ruckus and Fortinet FortiGate devices.
• Lumen says it has notified hundreds of victims over three years, in telecoms, government, defence contracting, IT services and critical infrastructure; Hawaii, California and Texas were the most targeted US states.
• Attribution to Volt Typhoon is Lumen's assessment; the report rates the KACE zero-day as moderate confidence.

What to do

The report's advice is about the management layer rather than one patch. Which of these apply depends on what you run:

• Cisco Catalyst SD-WAN Controller and Manager: CVE-2026-20127 (CVSS 10.0, authentication bypass) was disclosed and fixed in February 2026, and Lumen says exploitation continued after disclosure. Upgrade to a fixed release listed in Cisco's advisory. The Hacker News, reporting on the February disclosure, lists releases such as 20.12.6.1, 20.15.4.2 and 20.18.2.1 for different lines, but its version strings were garbled in places, so use Cisco's own advisory to pick yours. Check /var/log/auth.log for "Accepted publickey for vmanage-admin" from addresses that are not your SD-WAN system IPs.
• VeloCloud Orchestrator (on-premises): CVE-2026-16812 is an unauthenticated OS command injection, CVSS 10.0, which Arista advised on 27 July 2026 and said was already exploited. BleepingComputer lists the fixed versions as 5.2.3.14, 6.1.3.4, 6.4.2.4 and 7.0.0.1 and says hosted and dedicated deployments were patched earlier. Restrict the web interface to admin networks and review logs for the addresses BleepingComputer lists (8.19.75.217, 206.72.242.124 and 206.72.242.162, not a complete list). If you suspect a compromise, preserve logs before patching and rotate credentials, because patching does not remove an existing intruder.
• N-able N-central, Versa Director, Quest KACE: apply the vendor's current updates. Lumen says Quest released security updates in October 2025, after which KACE activity declined.
• Everything with an admin interface on the internet: inventory it, put it behind a VPN, jump host or management network, centralise logs and keep them longer, and hunt for unusual admin logins, unusual API use, remote file transfers and configuration changes. Lumen also points to CISA advisories AA24-038A and AA26-113A and to NCSC guidance.

What happened

Lumen's report, written by Michael Horka, describes Silent Train as an "operational framework" for Volt Typhoon rather than a botnet in the usual sense. Sessions start on rented servers outside the US, pass through compromised small-office and IoT devices in other countries, then through compromised devices inside the US, and only then reach the victim. Lumen counts about four hops before traffic enters US address space and one more before the target; some chains reached six hops.

Two details make it hard to defend against. First, chains are short-lived: Black Lotus Labs says they can be built in under two minutes and are dismantled after use, with disposable relays typically cleaned up within hours of a session ending. Horka told CyberScoop that the rotation keeps the number of live nodes at any moment close to zero. Second, each device type kept one fixed role for the full three years: Intelbras modems only as overseas relays, Netgear Orbi routers only as US exits. Lumen says some relay device types had no known vulnerabilities, which it reads as a sign that undisclosed flaws were used to build the network.

From early 2025 Lumen says the actor added enterprise platforms as longer-lived final hops that stayed active for one to three months, a hybrid model. Compromising a central management product, such as an SD-WAN orchestrator or a remote-management tool, gives access to the customers it manages without noisy lateral movement.

Background

Volt Typhoon is a China-linked group that US agencies say is pre-positioning in critical infrastructure. In advisory AA24-038A on 7 February 2024, CISA, the NSA and the FBI assessed that the group was positioning itself in IT networks of communications, energy, transportation and water operators to enable disruption in a crisis, and said it relies heavily on living-off-the-land techniques, using built-in system tools and valid credentials rather than custom malware.

The FBI and Justice Department disrupted the group's KV Botnet in early 2024, according to CyberScoop. Lumen says consistent Silent Train activity began in late 2023, shortly before the initial KV-botnet takedown, and that it expanded after the second disruption, with faster rotation of device types and locations. CyberScoop likewise reports that the group relied more on Silent Train after the KV Botnet disruption.

How it works

Lumen counts five zero-day campaigns run through the network, four confirmed and one likely:

Product	Identifier	What Lumen says
Quest KACE (endpoint management)	none identified	More than 30 victims; moderate-confidence zero-day assessment; credentials harvested, no lateral movement
Versa Director (SD-WAN)	none cited	In-memory JAR webshell; previously documented by Black Lotus Labs in mid-2024
N-able N-central (remote management)	CVE-2025-8875, CVE-2025-8876	Chain of previously undisclosed flaws
Cisco Catalyst SD-WAN	CVE-2026-20127, CVSS 10.0	Targeted trusted peering; disclosed February 2026, exploitation continued
VeloCloud Orchestrator	CVE-2026-16812	Third SD-WAN platform exploited after Versa and Cisco

Lumen notes that its telemetry could not always show whether access used known or unknown flaws. The post-exploitation pattern was consistent: in-memory webshells, credential harvesting, use of native remote-control and file-transfer features, and tampering with logs.

Activity ran Monday to Friday, mostly 09:00 to 22:00 China Standard Time, with pauses around Chinese New Year. Lumen concludes that human operators were working, and says the timing "matches" military rotation schedules, an inference rather than proof.

What it means

For defenders of edge and management systems. Lumen's central message is that the control plane is the target: orchestrators, SD-WAN managers, endpoint-management servers and remote-monitoring tools reach many downstream networks from one login. Treat them as the highest-value assets on the network, not as IT utilities. That means no direct internet exposure, a fast patch path, and logs shipped off the box.

For anyone who tries to block by IP. Because chains are rebuilt every day, address blocklists age quickly. Horka told CyberScoop the network is "fundamentally difficult to disrupt because there isn't one network to take down". Detection has to look at behaviour on your own systems: odd admin logins, unexpected outbound connections from a management server, new SSH keys or services.

For consumers and small offices. Your old router may be someone's relay. The report names common consumer and small-business brands among the exploited device classes. Naming a brand means attackers found exploitable devices of that type, not that every unit is affected; the practical steps are to replace end-of-life routers, update firmware, and disable remote administration you do not use.

What we don't know yet

• Which specific vendors' devices remain exploitable. Lumen says some relays had no known vulnerabilities, so their entry point is unknown.
• The true scale. Lumen says hundreds of victims were notified, and Horka cautioned that the report is not a complete census of the group's activity.
• Session length: Lumen's text says sessions averaged about four hours, while a figure caption in the same report says most lasted about 8 to 10 hours. CyberScoop repeats the four-hour figure, BleepingComputer reports relays being cleaned up within about eight hours. We report both and cannot resolve them.
• Whether any of the vendors will publish new advisories. CyberScoop reports no statements from Cisco, Arista, N-able, Quest or Versa.
• Attribution rests on Lumen's analysis, which is a vendor assessment. We have not seen a government statement on this report.

What to watch next

• Updated advisories from Quest, for the suspected KACE zero-day, which has no CVE yet.
• Any CISA or NCSC guidance that builds on this report; Lumen references CISA's AA26-113A on covert networks of compromised devices.
• Whether other management products named in the report's wider victim list, among them ManageEngine, Ivanti, F5, Check Point, Palo Alto Networks and ServiceNow, publish advisories.
• Indicators of compromise, which are in Lumen's report rather than in the press coverage.

Sources

• Silent Train: uncovering Volt Typhoon's operational framework for zero-day exploitation and strategic access (Lumen Black Lotus Labs, primary source)
• Volt Typhoon hides zero-day attacks using 'Silent Train' framework (BleepingComputer, 28 October 2026)
• Researchers uncover Volt Typhoon's covert, ephemeral network (CyberScoop, 28 October 2026)
• Arista patches VeloCloud Orchestrator zero-day exploited in attacks (BleepingComputer)
• Cisco SD-WAN zero-day CVE-2026-20127 (The Hacker News, 26 February 2026)
• CISA advisory AA24-038A, PRC state-sponsored actors compromise and maintain persistent access to US critical infrastructure (CISA, 7 February 2024)