Lumen Says Volt Typhoon Exploited at Least Four Zero-Days for Access

Organisations that run SD-WAN controllers, endpoint management servers and other central admin systems should treat them as prime targets and lock them down now, Lumen’s Black Lotus Labs said on 28 October. The advice comes with a report on “Silent Train”, a covert network that Lumen says China’s Volt Typhoon group used to reach some of the most sensitive networks in the US.

In the Black Lotus Labs report, Lumen says it has tracked Silent Train for three years and sent hundreds of victim notifications. Those notifications led to investigations that uncovered “at least one likely and four confirmed zero-day campaigns” against management and control systems. Zero-days are flaws attackers use before a fix exists.

What Lumen tells defenders to do first

Lumen’s recommendations centre on the systems that manage other systems. It says organisations should apply “heightened security controls” to network and endpoint management tools, SD-WAN orchestrators and out-of-band platforms, and regularly review the permissions and trust relationships those platforms grant.

It also advises organisations to:

• inventory and minimise internet-facing admin services and portals;
• reach admin interfaces only through VPNs, access controls, jump hosts or dedicated management networks;
• patch flaws in management and control systems first;
• centralise logs and keep them for longer;
• look for unusual admin logins, odd API use, remote file transfers and configuration changes, especially outside normal working hours.

Lumen points defenders to CISA and NCSC guidance on Volt Typhoon and on China-linked covert networks. The UK’s NCSC led a joint advisory in April with partners including CISA, the FBI and the NSA, which said such networks had been used by Volt Typhoon “to pre-position offensive cyber capabilities on critical national infrastructure”.

How Silent Train hides its traffic

Instead of running a large, lasting botnet, Lumen says Volt Typhoon assembled a fresh chain of compromised devices for each operation. Traffic started on rented servers outside the US, passed through hacked home and office routers, Internet of Things devices and enterprise kit, and left through a device inside the US. Lumen counted more than 27 device types, from TP-Link routers and Netgear Orbi systems to Fortinet appliances.

The chains were short-lived. Lumen says operators could exploit devices and build a chain “in under two minutes”, then removed their tools and dismantled it when the session ended. “Volt Typhoon demonstrated a repeatable capability to rebuild a new chain with different infrastructure in less than two minutes, making the number of nodes at any one moment effectively close to zero,” Michael Horka of Black Lotus Labs told CyberScoop, which reported sessions averaging “roughly four hours”.

Lumen says activity followed a weekday schedule in Chinese working hours and slowed for several weeks around Chinese New Year. Each session typically went after one to five victims.

The flaws behind the campaigns, and their fixes

Several of the flaws Lumen describes have fixes and public advisories. Lumen says that by late 2025 the group was exploiting CVE-2026-20127 in Cisco Catalyst SD-WAN, a flaw rated the maximum 10.0. Cisco published its advisory on 25 February 2026, and CISA issued an alert and an emergency directive the same day. Lumen says exploitation “continued well after” the disclosure.

Lumen also says the group used a zero-day in VeloCloud Orchestrator, later named CVE-2026-16812. Arista, which now owns VeloCloud, said in Security Advisory 0144 in July that the flaw was “known to be actively exploited”, and advised limiting the orchestrator’s web interface to trusted admin networks. Arista patched a separate exploited VeloCloud flaw last week.

The report also covers two N-able N-central flaws, CVE-2025-8875 and CVE-2025-8876, and likely zero-day activity against Quest KACE endpoint management. Lumen publicly documented the group’s exploitation of Versa Director in mid-2024.

Who Lumen says was targeted

Lumen lists US government networks, telecoms providers, defence contractors, satellite communications firms, managed service providers, universities with military links and critical infrastructure operators. Hawaii, California and Texas “consistently emerged as the most targeted regions”, it says, noting that these states host major military bases and communications infrastructure.

A network that is never there is hard to block

Silent Train’s design undercuts one of the oldest defensive habits: blocking known bad addresses. If a relay chain exists only for a few hours and is rebuilt from different devices each time, a list of IP addresses is out of date before it is shared. The April advisory made the same point, warning that static block lists “will be less effective” against covert networks.

That is why Lumen’s advice concentrates on the target end. Defenders cannot easily see the chain, but they can control who reaches an SD-WAN controller or a remote-management server, and spot an admin session that should not be happening. Those systems are attractive because one compromise can open many networks, including those of an MSP’s customers.

The findings come with limits. The attribution and the session details come from Lumen’s own visibility as a large network operator, and Cisco’s and Arista’s advisories confirm the flaws and their exploitation but neither names an attacker. Lumen has not said how many organisations were breached, as opposed to notified. Takedowns have not ended the activity either: Lumen says Silent Train began shortly before the late-2023 disruption of KV-botnet, which it worked on with US agencies, and grew after a second disruption.

Other moves against hidden attack infrastructure

Silent Train follows other moves against hidden attack infrastructure, including the FBI’s takedown of tools tied to Flax Typhoon this month. This week the FBI also seized the Virtualine hosting domain, and researchers recently found an Iran-linked server hidden on US soil.

For defenders, the immediate step is to check that the Cisco and VeloCloud fixes are applied and that admin interfaces are off the open internet.

Sources

• Lumen Black Lotus Labs, “Silent Train: uncovering Volt Typhoon’s operational framework for zero-day exploitation and strategic access”, 28 October 2026
• Cisco Security Advisory, Catalyst SD-WAN peering authentication bypass (CVE-2026-20127), first published 25 February 2026
• CISA, “CISA and Partners Release Guidance on Ongoing Global Exploitation of Cisco SD-WAN Systems”, 25 February 2026
• Arista, Security Advisory 0144 (CVE-2026-16812), July 2026
• NCSC and partners, “Defending Against China-Nexus Covert Networks of Compromised Devices”, via CISA, 23 April 2026
• CyberScoop, Matt Kapko, 28 October 2026

Related stories

• Arista Patches 9.9-Rated VeloCloud Orchestrator Zero-Day Under Attack
• The FBI Takes Down Two Hacking Tools Tied to “Flax Typhoon”: What Happened and Why It Matters
• FBI Seizes Virtualine Domain as Dutch Police Take Servers Offline
• Iran-Linked Prince of Persia Hid a Server on US Soil, Semperis Says