Lumen’s Black Lotus Labs has published its account of “Silent Train,” the relay framework it attributes to Volt Typhoon, describing chains of compromised devices that were assembled in under two minutes, used for hours and then erased, and that fed four confirmed zero-day campaigns against management platforms.
The report, published October 28, rests on three years of monitoring. Black Lotus Labs says it first saw consistent Silent Train activity in November 2023 and has since notified hundreds of victims. This feature walks through how the framework is built, which platforms it was pointed at, what the vendors have published about those flaws, and what a security leader can change this quarter. Everything below comes from the primary documents named in each section. The attribution to Volt Typhoon is Black Lotus Labs’ assessment, and we report it as theirs.
What Silent Train is
Black Lotus Labs separates Silent Train from a botnet, a proxy network or an operational relay box network. In the report, whose analysis Lumen credits to Michael Horka of Black Lotus Labs, Silent Train “is built around rapidly rotating chains of compromised SOHO, IoT and enterprise devices that are exploited on demand, used against carefully selected targets, cleaned up after each operation and continuously refreshed.”
A session starts at a virtual private server outside the United States and passes through a second server, then through compromised non-U.S. small-office and IoT devices, and finally through compromised devices inside the U.S. before it reaches the victim. Lumen’s figure shows an average of four nodes before the traffic enters U.S. address space and one more hop after that. In some cases as many as six hops separated the operator from the victim.
The report puts the speed of assembly at under two minutes and the average session at about four hours, with some lasting only minutes. At the end of a session the operators removed every artifact and dismantled the chain. Lumen concludes from the tempo that provisioning was semi-automated. It adds that sessions ran Monday through Friday, mostly between 09:00 and 22:00 China Standard Time, with multiweek pauses around the Chinese New Year, which it reads as hands-on work by people on a shift pattern.
Fixed roles for each device
Lumen stresses operational discipline. Each device type held one position in the chain for the whole observation period. Intelbras modems appeared only as overseas relays, and Netgear Orbi devices served as the U.S. hops that touched victims. The report counts more than 27 device classes, from TP-Link routers and Netgear Orbi units to Fortinet appliances and CyberPanel servers. Some relay types had no known vulnerability, which Lumen takes as a sign that Volt Typhoon held undisclosed exploits just to set up a single relay.
New device classes followed a pattern. Operators tested a class outside the U.S. first, then used it in chains months later, adding roughly one device type per quarter and about one a month during the 2023 to 2024 build-out. Early chains used disposable SOHO and IoT gear that was restored to its prior state after each session. By early 2025, enterprise platforms including Fortinet, Cisco, PRTG, Mirth Connect and CyberPanel became optional final hops that stayed in service for one to three months and supported several intrusions. Lumen calls the result a hybrid framework. Reverse tunnels built on open-source proxies such as Chisel and FRP ran alongside the older SSH-chaining model, and the report says the variants coexisted and did not replace each other.
The pattern in the zero-days
Silent Train was reserved for exploitation, credential access, exfiltration and ongoing work inside victim environments, and sessions usually involved one to five victims, often a single organization. Watching the chains gave Lumen early sight of exploitation. The report identifies one likely and four confirmed zero-day campaigns, and every one of them hit a management or control plane platform.
Lumen lists them as follows. Quest KACE, an endpoint management suite, was hit in a campaign affecting more than 30 victims that declined after Quest’s October 2025 updates, assessed at moderate confidence as a zero-day. Versa Director was documented by Black Lotus Labs in mid-2024. N-able N-central was exploited through CVE-2025-8875 and CVE-2025-8876. Cisco Catalyst SD-WAN was exploited through CVE-2026-20127 by late 2025, and exploitation continued after Cisco’s February 2026 disclosure. VeloCloud Orchestrator was exploited through a zero-day later designated CVE-2026-16812. The report does not assign fault to any vendor. It names these platforms because of the access they hold.
Lumen’s explanation is about access. A threat actor that lands on an ordinary server has to move across the network, find administrators and build several footholds. A management platform already has visibility, access and administrative reach, so one compromise delivers what a full intrusion would, with fewer authentication events and fewer forensic artifacts. The report’s Figure 8 describes one compromised platform giving “admin access to thousands of devices and trusted paths to downstream customers, with no lateral movement.” Post-incident analysis with partners found in-memory webshells, credential harvesting and abuse of native features such as endpoint control and remote file transfer. In several cases the actors also erased or altered logs and other evidence.
Who it was used against
Lumen lists telecommunications providers, government networks, defense contractors, satellite and mission-critical communications providers, managed service providers, universities with military affiliations and critical infrastructure operators among the victims it notified. The report says Hawaii, California and Texas were the most targeted regions from November 2023 to July 2026 and ties that to military installations, telecommunications hubs and logistics networks supporting U.S. operations in the Indo-Pacific. It states that the reason for the concentration is unclear. What these victims share, in Lumen’s reading, is a trusted or connected position, since each offers a route to customers, partners or essential operations.
What the vendors have published
Cisco’s advisory cisco-sa-sdwan-rpa-EHchtZk, first published February 25 and last updated October 28, rates CVE-2026-20127 at CVSS 10.0. It states that “This vulnerability exists because the peering authentication mechanism in an affected system is not working properly.” An unauthenticated remote attacker could obtain administrative privileges on an affected Controller, Manager or Validator, reach NETCONF and manipulate network configuration for the SD-WAN fabric. Cisco lists no workarounds and says the flaw affects on-premises and Cisco-hosted deployments regardless of device configuration. Our brief on the October 28 advisory update lists the fixed releases, and an earlier brief covers an exploited SD-WAN Manager authentication bypass.
N-able’s 2025.3.1 release notes, last updated October 21, 2025, call the fix for CVE-2025-8875 and CVE-2025-8876 a “critical security fix.” The notes say the flaws “require authentication to exploit,” and also that “there is a potential risk to the security of your N-central environment, if unpatched.” The page tells customers to upgrade on-premises N-central to 2025.3.1 and ends that guidance with “Make sure MFA is enabled”. Our earlier coverage of a fourth N-central hotfix covers an earlier September update for the same product.
Lumen’s separate 2024 report on Versa Director describes CVE-2024-39717, a zero-day exploited at four U.S. victims and one non-U.S. victim in the ISP, MSP and IT sectors as early as June 12, 2024. Actors gained initial administrative access over an exposed management port meant for high-availability pairing of Director nodes, then deployed an in-memory web shell the report calls VersaMem to harvest credentials. Black Lotus Labs attributed that activity with moderate confidence to Volt Typhoon, also tracked as Bronze Silhouette, and urged an upgrade to version 22.1.4 or later. The Silent Train report lists Versa Director among its four confirmed zero-day campaigns.
What it means for the security leader
The common thread across Quest, Versa, N-able, Cisco and VeloCloud is the position of the product, and none of the five is a user-facing application. Each one holds credentials or administrative reach over many other systems. In our reading, the inventory most organizations keep ranks assets by data value and internet exposure, and the Silent Train list argues for a third column: how many other devices this system can administer. A SD-WAN orchestrator, an endpoint management server and a remote monitoring console rank highest on that measure and are often patched on the same cycle as a print server.
Lumen’s guidance is specific and short. It asks organizations to apply heightened controls to network and endpoint management systems, SD-WAN orchestrators and out-of-band platforms, and to review the permissions and trust relationships those platforms grant downstream. It asks them to inventory internet-facing administrative interfaces and restrict direct access through VPNs, jump hosts or dedicated management networks. It asks them to prioritize patching for management and control plane technologies, to centralize logging with longer retention, and to hunt for unusual administrative logins, abnormal API use, remote file transfers and configuration changes outside normal hours. It points readers to CISA and NCSC guidance on Volt Typhoon and on China-nexus covert networks.
The log guidance carries weight because of what Lumen says the actors removed. When chains vanish within hours and some intrusions end with altered or erased logs, the records that survive are the ones exported off the platform before the intrusion. Our feature on the Flax Typhoon advisory covers persistence on VPN gear, and our opinion on replacing an exploited edge appliance covers the rebuild decision once a platform has been touched.
Where to start this quarter
Three actions follow directly from the primaries. First, list every management and control plane product in your estate, with the version, the exposure of its administrative interface and the number of systems it can administer, and patch the ones in the Cisco, N-able and Versa advisories above first. Second, move the administrative interfaces of those products behind a management network or jump host, since the Versa case turned on a port that was reachable from outside. Third, export authentication, API and configuration-change logs from each platform to a store the platform itself cannot write to, and keep retention as long as storage allows, since Lumen has tracked this framework for three years.
Black Lotus Labs also says its “telemetry could not always determine whether access involved known or undisclosed vulnerabilities.” That limit applies to defenders too. A clean result from a search of your own logs is only as good as the retention behind it, so the first step is to find out how far back your management platforms’ logs actually go.
Source: Lumen Black Lotus Labs, Silent Train: uncovering Volt Typhoon’s operational framework
