Ethical Hacking News
Lumen has uncovered a sophisticated network used by the China-linked APT group, Volt Typhoon, to hide zero-day attacks on critical systems. The Silent Train network, comprising of hundreds of victim notifications and numerous investigations, was designed to conceal the group's activity while exploiting previously unknown vulnerabilities in centralized management platforms. The group targeted tools used to manage endpoints and networks, as well as SD-WAN systems and other control platforms, leaving few traces behind. With this revelation, enterprise leaders are urged to take immediate action to reduce internet exposure, accelerate patching, strengthen access controls, and preserve security telemetry to detect threats earlier and limit their impact.
Volt Typhoon, a China-linked APT group, has been using the Silent Train network to hide zero-day attacks on critical systems. The network, discovered by Lumen's Black Lotus Labs, has been tracking the group's activities for three years, revealing a complex web of deception and exploitation. The Silent Train network targets tools used to manage endpoints and networks, as well as SD-WAN systems and other control platforms. The group exploited previously unknown vulnerabilities in centralized management platforms, using rapidly changing chains of compromised infrastructure to conceal its activity. The attackers used devices with no known vulnerabilities, as well as SOHO and IoT devices, to compromise systems. The group targeted high-value systems, including those in the energy, transportation, and defense sectors, and was able to stay in the system for up to four hours. Cisco's CVSS 10.0 flaw was exploited by the group, and they continued to exploit it even after Cisco disclosed the bug. Reducing internet exposure, accelerating patching, strengthening access controls, and preserving security telemetry are essential to detecting threats earlier and limiting their impact.
Volt Typhoon, a China-linked Advanced Persistent Threat (APT) group, has been utilizing a sophisticated network known as Silent Train to hide zero-day attacks on critical systems. This covert network, discovered by Lumen's Black Lotus Labs, has been tracking the group's activities for three years, revealing a complex web of deception and exploitation that spans across multiple continents.
The Silent Train network, comprising of hundreds of victim notifications and numerous investigations, was designed to conceal the group's activity while exploiting previously unknown vulnerabilities in centralized management platforms. Each session, lasting an average of four hours, targeted between one and five victims, often just one organization. The group's tactics involved using rapidly changing chains of compromised infrastructure to conceal its activity, with an average of four devices passing through before reaching a U.S. IP address.
Lumen identified over 27 types of devices used in the network, including SOHO and IoT devices, enterprise platforms, and even devices with no known vulnerabilities, suggesting that Volt Typhoon may have used previously unknown exploits to compromise them. The attackers exploited exposed web interfaces and installed only the tools needed to connect the devices through SSH. At the end of each session, they removed all traces of their activity and dismantled the relay chain.
The group targeted tools used to manage endpoints and networks, as well as SD-WAN systems and other control platforms. These systems can manage hundreds or thousands of devices, allowing attackers to reach many systems without moving through the network in the usual way. This approach also helped them leave fewer traces. After the attacks, investigators found webshells running in memory, stolen credentials, misuse of built-in features such as remote file transfers, and deleted logs.
The four confirmed zero-day campaigns hit Versa Director in 2024, N-able N-central through CVE-2025-8875 and CVE-2025-8876, Cisco Catalyst SD-WAN through CVE-2026-20127, and VeloCloud Orchestrator through CVE-2026-16812. The Cisco bug is a CVSS 10.0 flaw, and the group kept exploiting it well after Cisco disclosed it in February 2026. In the Versa case, the group used an in-memory JAR webshell to limit forensic evidence and reach downstream customers.
The actor stayed on the KACE server and used its admin features to take credentials. Victims include telecoms, government agencies, defense contractors, satellite and emergency communications, universities with ROTC programs, managed service and IT firms, and critical infrastructure such as water, energy, transportation, maritime, rail, and aviation. Hawaii, California, and Texas were the top locations for several years. Lumen cannot say why, but the pattern fits pre-positioning for a crisis in the Indo-Pacific.
For enterprise leaders, the lesson is clear: systems with broad administrative reach can become high-value gateways to the entire organization and its customers. Reducing internet exposure, accelerating patching, strengthening access controls, and preserving security telemetry are essential to detecting threats earlier and limiting their impact.
Related Information:
https://www.ethicalhackingnews.com/articles/Unveiling-the-Sinister-Network-of-Volt-Typhoon-A-Web-of-Deception-and-Exploitation-ehn.shtml
https://securityaffairs.com/202023/intelligence/volt-typhoon-used-silent-train-to-hide-zero-day-attacks.html
https://nvd.nist.gov/vuln/detail/CVE-2025-8875
https://www.cvedetails.com/cve/CVE-2025-8875/
https://nvd.nist.gov/vuln/detail/CVE-2025-8876
https://www.cvedetails.com/cve/CVE-2025-8876/
https://nvd.nist.gov/vuln/detail/CVE-2026-20127
https://www.cvedetails.com/cve/CVE-2026-20127/
https://nvd.nist.gov/vuln/detail/CVE-2026-16812
https://www.cvedetails.com/cve/CVE-2026-16812/
Published: Thu Oct 29 08:51:08 2026 by llama3.2 3B Q4_K_M
