Volt Typhoon Silent Train Network Tied to 4 US Zero-Day Campaigns

Volt Typhoon is a Chinese state-sponsored advanced persistent threat actor, tracked as G1017 by MITRE and Bronze Silhouette by some vendors, formally attributed by CISA, NSA, FBI, and Five Eyes partner agencies in joint advisory AA24-038A. Unlike ransomware groups that seek immediate financial return, Volt Typhoon's documented mission is pre-positioning: gaining persistent access inside US critical infrastructure to enable disruption capability if a geopolitical crisis escalates.

The group avoids custom malware almost entirely, relying on living-off-the-land techniques that blend into normal network administration traffic. Operators use built-in Windows utilities (wmic, netsh, PowerShell, ntdsutil), legitimate network tunneling tools (Chisel, FRP), and valid administrator accounts to move laterally and maintain access across months and years. CISA advisories note that some indicators "can also be legitimate system administration commands that appear in benign activity," making signature-based detection largely ineffective.

Volt Typhoon has sustained access inside US networks through staff turnover at victim organizations, suggesting the persistent foothold survives personnel changes that would normally trigger access reviews. Targeting is concentrated in sectors defined as critical infrastructure by the US Department of Homeland Security: telecommunications carriers (the backbone for emergency and military communications), defense industrial base contractors, water and wastewater systems, energy grid operators, and transportation logistics.

The October 28 Black Lotus Labs report represents the most detailed technical breakdown of how Volt Typhoon operationalized these intrusions through the Silent Train relay infrastructure. Defenders tracking Flax Typhoon, another Chinese APT profiled in our October 11 analysis, will recognize the shared emphasis on SOHO infrastructure abuse and contractor-ecosystem entry points common across PRC-linked threat actors.

Silent Train is not a single piece of malware -- it is an operational relay methodology. Volt Typhoon compromises SOHO routers (end-of-life Cisco and NETGEAR models dominate), IoT devices, and enterprise networking equipment, then chains them into multi-hop relay paths. Each node in the chain runs a temporary SSH service, a Chisel or FRP reverse tunnel, or both, creating an encrypted path from the operator back to the victim network that obscures the true origin of the traffic.

The chains reach up to six intermediary hops, with each hop in a different autonomous system or geographic region. Traffic traversing a six-hop Silent Train chain appears to originate from a domestic US host in the final hop, passing through multiple corporate or residential networks before reaching the operator in a PRC-aligned jurisdiction. Traditional IP-block based detection fails because the exit node IP changes each session.

Operational security is the defining feature. At the end of each access session, Volt Typhoon removes every artifact: temporary service configurations, SSH keys, tunnel binaries, and log entries. Black Lotus Labs researchers confirm the group can rebuild a complete replacement relay chain -- with different entry and exit IPs, different intermediate nodes, and new authentication keys -- in under two minutes. This reconstruction speed means even a successfully identified and blocked relay chain provides only momentary disruption.

The SOHO devices in the relay chains are not themselves targeted for exploitation of sensitive data. They are used exclusively as relay nodes to obscure the attacker's true location. Organizations running consumer-grade or end-of-life SOHO routers on the network perimeter should treat anomalous outbound SSH sessions or unusual Chisel/FRP binaries as a Silent Train indicator, even if those devices have no other compromise signals.

Black Lotus Labs tied Silent Train to four confirmed zero-day exploitation campaigns, each targeting widely deployed enterprise infrastructure.

CVE-2024-39717 (Versa Director): An arbitrary file upload vulnerability in Versa Networks' SD-WAN management platform. Volt Typhoon exploited it to gain remote code execution on Versa Director instances managing SD-WAN deployments at telecom and ISP customers. Patch has been available since August 2024; organizations still on vulnerable versions should treat this as an active exposure.

CVE-2025-8875 and CVE-2025-8876 (N-able N-central): A pair of critical flaws in N-able's remote monitoring and management platform. N-central's deep agent-based access across managed endpoints makes it a high-value lateral movement target: a single N-central compromise gives an attacker administrative reach to every managed device in the platform. Volt Typhoon exploited both flaws to gain persistent access in managed service provider environments serving critical infrastructure customers.

CVE-2026-20127 (Cisco Catalyst SD-WAN): A critical vulnerability in Cisco's Catalyst SD-WAN appliances allowing unauthenticated remote command execution. Cisco disclosed this flaw on February 25, 2026, and Black Lotus Labs reports that Volt Typhoon continued exploiting it against unpatched devices in the weeks following disclosure, confirming N-day exploitation even after patch availability.

CVE-2026-16812 (Arista VeloCloud Orchestrator, CVSS 10.0): The most recent and most severe of the four CVEs. An unauthenticated OS command injection in VeloCloud's web interface allows a remote attacker with only network reach to the VCO panel to execute arbitrary OS commands as root. Arista confirmed active exploitation by Volt Typhoon, published known malicious IPs in the advisory, and fixed the issue in VCO versions 5.2.3.14, 6.1.3.4, 6.4.2.4, and 7.0.0.1.

Researchers also assess a fifth campaign against Quest KACE appliances as likely, though confidence is lower without confirmed CVE attribution. For context on how the SD-WAN category has been a consistent Volt Typhoon target, see our Cisco SD-WAN CVE-2026-76504 patch analysis.

Volt Typhoon's documented techniques map directly to MITRE ATT&CK, enabling structured detection logic across any logging environment.

Reconnaissance (TA0043): T1592 - Gather Victim Host Information. Volt Typhoon profiles target network topology through compromised relay nodes before initiating zero-day exploitation, prioritizing management interfaces with the broadest downstream access.

Resource Development (TA0042): T1584.001 - Compromise Infrastructure: Botnet. Silent Train is built from thousands of compromised SOHO and IoT devices organized into ephemeral relay chains. T1650 - Acquire Access. Black Lotus Labs notes Volt Typhoon uses existing Silent Train nodes in one target sector to facilitate access into adjacent sectors, treating each foothold as infrastructure for the next campaign.

Initial Access (TA0001): T1190 - Exploit Public-Facing Application. All four confirmed CVE campaigns used unauthenticated or low-privilege network-accessible exploits against management interfaces. T1133 - External Remote Services. VPN and remote access platforms (Cisco SD-WAN, VeloCloud, N-central) were targeted specifically because they proxy access to internal networks.

Defense Evasion (TA0005): T1070.004 - Indicator Removal: File Deletion. Every Silent Train session ends with artifact removal: service configs, SSH keys, tunnel binaries, and log entries. T1036 - Masquerading. Volt Typhoon names malicious processes and files to match legitimate system administration utilities. T1090.003 - Proxy: Multi-hop Proxy. The relay chain structure itself is the primary defense evasion mechanism -- up to six legitimate-looking hops separate operator from victim.

Persistence (TA0003): T1505.003 - Server Software Component: Web Shell. Web shells planted on compromised management platforms maintain access independent of the initial vulnerability. T1078 - Valid Accounts. Volt Typhoon harvests valid credentials from compromised management platforms to authenticate legitimately on subsequent access.

Command and Control (TA0011): T1572 - Protocol Tunneling. Chisel and FRP create encrypted tunnels over HTTP/HTTPS that blend with legitimate web traffic on non-standard ports. T1571 - Non-Standard Port. Relay nodes expose temporary SSH services on high non-standard ports (above 1024) to avoid firewall rules targeting port 22.

Three concrete network indicators are confirmed in Arista's advisory for CVE-2026-16812. Block these at your perimeter firewall and NGFW today.

Additional behavioral indicators come from documented Silent Train operational patterns. No new C2 infrastructure for the October 2026 campaign disclosure has been published by Lumen at time of writing; the following structural/behavioral IOCs are derived from the documented attack patterns in the Black Lotus Labs report and should be validated in your environment before enabling automatic blocking.

These two rules target Silent Train relay node behavior (Chisel/FRP tunnel deployment on network devices) and Volt Typhoon LOTL post-exploitation commands in Windows network appliance environments. Both carry experimental status; validate against your environment log format before enabling automatic blocking.

Standard signature-based detection misses most Volt Typhoon activity. The group's LOTL approach means the malicious actions look identical to legitimate network administration. Effective detection requires behavioral analytics and anomaly detection tuned to the specific context of critical infrastructure management environments.

Silent Train is not a ransomware campaign. There are no encrypted files, no ransom notes, no immediate business disruption. That is the point. Volt Typhoon's mission is pre-positioning: establishing persistent, undetected access inside US critical infrastructure that can be activated for disruption if US-China geopolitical tensions escalate to crisis or conflict.

CISA advisories note that Volt Typhoon access has persisted through staff turnover at victim organizations. The groups pre-positioned access survived personnel changes that would normally trigger credential rotation and access reviews. If Volt Typhoon is inside your network today, routine IT procedures will not evict them.

The four zero-day campaigns linked to Silent Train targeted the management plane of critical infrastructure: SD-WAN controllers, RMM platforms, and network management interfaces. Compromise at the management layer gives an attacker administrative reach to every device managed from that platform. A single VeloCloud Orchestrator compromise translates to potential command over every SD-WAN edge appliance in the managed environment.

California, Texas, and Hawaii concentration is not random. These regions host major military installations, Pacific-facing port infrastructure, submarine cable landing stations, and grid interconnects. Volt Typhoon's targeting reflects a strategic calculus about which infrastructure disruption would have the highest operational impact during a Pacific crisis.

For organizations in the targeted sectors, the actionable posture is clear: patch the four CVEs, block the three known C2 IPs, deploy the Sigma rules and hunt queries above, and engage your CISA regional contact for sector-specific threat briefings. The access may already be there. The question is whether you find it before it is used.