// AI threat desk · 29 Oct 2026
Home/CVE · Vulns & Patches
Vulns & PatchesCriticalCVECVSS 10.0

Lumen: Volt Typhoon exploited four confirmed zero-days via Silent Train network

Lumen said its monitoring helped uncover at least four confirmed and one likely zero-day vulnerabilities that Volt Typhoon exploited.

· 2 min read
AI-generated image of security analysts monitoring a cyberattack investigation in a dim operations centre.
AI-generated image, not a photo of the event.
Key takeaways
  • Lumen identified at least four confirmed and one likely zero-day vulnerabilities exploited by Volt Typhoon.
  • A likely Quest KACE campaign affected more than 30 victims and declined after October 2025 security updates.

Lumen said its monitoring helped uncover at least four confirmed and one likely zero-day vulnerabilities that Volt Typhoon exploited, targeting network and endpoint management systems, SD-WAN orchestrators and control plane infrastructure.

The targeted systems provide visibility, administration and access across enterprise and customer environments.

Black Lotus Labs said Silent Train was first identified in late 2023 and supported vulnerability exploitation, credential access, data exfiltration and continued access to victim environments. Lumen said it first observed consistent activity in November 2023, before the initial KV-botnet takedown.

On this page

What happened

Lumen said the N-Central campaign involved previously undisclosed vulnerabilities assigned CVE-2025-8875 and CVE-2025-8876. It said Volt Typhoon exploited Cisco Catalyst SD-WAN through CVE-2026-20127 by late 2025, a critical vulnerability with a CVSS score of 10.0.

The group also exploited a VeloCloud Orchestrator zero-day later designated CVE-2026-16812. Lumen said exploitation of Cisco Catalyst SD-WAN continued after Cisco disclosed the vulnerability in February 2026.

TargetCVE or statusDetail
N-CentralCVE-2025-8875 and CVE-2025-8876Previously undisclosed vulnerabilities
Cisco Catalyst SD-WANCVE-2026-20127Exploited by late 2025; CVSS 10.0
VeloCloud OrchestratorCVE-2026-16812Zero-day later assigned the CVE
Quest KACELikely zero-day campaignMore than 30 victims

Silent Train rotated through 27 device classes

Black Lotus Labs said Silent Train used rotating chains of compromised SOHO, IoT and enterprise infrastructure, with anti-forensic techniques, compartmentalized operations and post-operation cleanup. It observed more than 27 device classes, including TP-Link routers, Netgear Orbi devices, Fortinet appliances and CyberPanel servers.

Operators could exploit and assemble chains in under two minutes, Lumen said. Sessions averaged about four hours, although some lasted only minutes, while compromised enterprise platforms remained active for one to three months and supported multiple intrusions before replacement.

Black Lotus Labs notified hundreds of victims

Lumen said Black Lotus Labs notified hundreds of victims during its tracking, collaboration and investigation work. The notified organizations included telecommunications providers, government entities, defense contractors, communication services, universities and IT firms, according to CyberScoop.

Black Lotus Labs said Silent Train activity focused on systems that, once breached, offered extensive visibility, control and access across large enterprise environments.

Lumen said Black Lotus Labs tracked Silent Train for more than three years, worked with public- and private-sector partners and delivered hundreds of high-priority victim notifications. It said the framework’s use of centralized management and control-plane technologies remained a consistent pattern.

Lumen recommended reducing internet exposure, accelerating patching, strengthening access controls and preserving security telemetry to detect threats earlier and limit their impact.

What to do now

  1. Restrict direct access to administrative interfaces through VPNs, access-control policies, jump hosts or dedicated management networks.

FAQ

What did Volt Typhoon use Silent Train for?

Black Lotus Labs said Silent Train supported vulnerability exploitation, credential access, data exfiltration and continued access to victim environments.

How fast could Volt Typhoon build a Silent Train chain?

Lumen said operators could exploit and assemble chains of devices in under two minutes.

Sources

  1. Silent Train: uncovering Volt Typhoon's operational framework for zero-day exploitation and strategic access, LumenPrimary
  2. The Botnet is Back: SSC STRIKE Team Uncovers a Renewed Cyber Threat - SecurityScorecard, SecurityScorecardPrimary
  3. Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns, The Hacker News
  4. Researchers uncover Volt Typhoon’s covert, ephemeral network, CyberScoop
  5. Volt Typhoon returns with fresh botnet attacks on critical US infrastructure, CSOonline
  6. U.S. agencies continue to observe Volt Typhoon intrusions, techtarget
How we checked this story
ClaimSourceStatus
The Hacker News attributed Silent Train to Volt Typhoon and said the network supported zero-day exploitation and strategic access.The Hacker NewsAttributed
Black Lotus Labs said Silent Train used rotating chains of compromised SOHO, IoT and enterprise infrastructure with anti-forensic techniques and cleanup.Black Lotus LabsAttributed
Black Lotus Labs said Silent Train supported exploitation, credential access, data exfiltration and continued access to victim environments.Black Lotus Labs, via The Hacker NewsAttributed
Lumen said it identified at least four confirmed and one likely zero-day vulnerabilities exploited by Volt Typhoon.LumenConfirmed
Lumen said the N-Central campaign involved previously undisclosed vulnerabilities assigned CVE-2025-8875 and CVE-2025-8876.LumenConfirmed
Lumen said Volt Typhoon exploited Cisco Catalyst SD-WAN through CVE-2026-20127 by late 2025.LumenConfirmed
Lumen said exploitation of Cisco Catalyst SD-WAN continued after Cisco disclosed the vulnerability in February 2026.LumenConfirmed
Lumen said Volt Typhoon exploited a VeloCloud Orchestrator zero-day later designated CVE-2026-16812.LumenConfirmed
Lumen said the likely Quest KACE zero-day campaign affected more than 30 victims and declined after October 2025 security updates.LumenConfirmed
Lumen said Black Lotus Labs first observed consistent Silent Train activity in November 2023, before the initial KV-botnet takedown.LumenConfirmed
Lumen said it notified hundreds of victims over more than three years of tracking Silent Train.LumenConfirmed
Lumen said Silent Train used more than 27 device classes, including SOHO, IoT and enterprise platforms.LumenConfirmed
Lumen said Silent Train sessions averaged about four hours, with some lasting only minutes.LumenConfirmed
Lumen said operators could exploit and assemble Silent Train chains in under two minutes.LumenConfirmed
Lumen said enterprise platforms remained active in Silent Train for one to three months and supported multiple intrusions.LumenConfirmed
Lumen said Silent Train targeted centralized management and control-plane technologies that provide broad administrative access and visibility.LumenConfirmed
Lumen recommended reducing internet exposure, accelerating patching, strengthening access controls and preserving security telemetry.LumenConfirmed
CyberScoop reported that Black Lotus Labs notified hundreds of victims across telecommunications, government, defense, communications, university and IT sectors.CyberScoopAttributed
Michael Horka told CyberScoop that Volt Typhoon could rebuild a new chain with different infrastructure in less than two minutes.Michael Horka, via CyberScoopAttributed
SecurityScorecard said Volt Typhoon’s earlier JDYFJ botnet used compromised Cisco and Netgear routers and command servers in the Netherlands, Latvia and Germany.SecurityScorecardAttributed
CSOonline reported that Volt Typhoon exploited outdated Cisco and Netgear routers to breach critical networks.CSOonlineAttributed
CSOonline reported that the renewed activity followed the dismantling of parts of Volt Typhoon’s botnet nearly ten months earlier.CSOonlineAttributed
SecurityScorecard’s Ryan Sherstobitoff said Volt Typhoon had returned more sophisticated and determined than before.Ryan Sherstobitoff, via CSOonlineAttributed
SecurityScorecard said attackers compromised around 30% of visible Cisco RV320/325 routers within 37 days.SecurityScorecard, via CSOonlineAttributed
CSOonline reported that Volt Typhoon used servers across Europe and Asia-Pacific to mask command-and-control operations.CSOonlineAttributed
CSOonline reported that Volt Typhoon used the JDYFJ SSL certificate cluster for encrypted communication.CSOonlineAttributed
CSOonline reported that a compromised VPN device in New Caledonia bridged Asia-Pacific and the Americas.CSOonlineAttributed
CSOonline reported that Volt Typhoon had reportedly breached Singapore Telecommunications before further intrusions targeting U.S. telecoms.CSOonlineAttributed
CSOonline reported that Lumen had previously said Volt Typhoon used CVE-2024-39717 to plant credential-stealing web shells.CSOonlineAttributed
TechTarget reported that CISA said Volt Typhoon had maintained access to some victim IT environments for at least five years.CISA, via techtargetAttributed
Cynthia Kaiser said Volt Typhoon activity was occurring every day and would remain a problem for multiple years.Cynthia Kaiser, via techtargetAttributed
CISA observed Volt Typhoon periodically exfiltrating files from Active Directory where credentials were stored.CISA, via techtargetAttributed
Andrew Scott said Volt Typhoon targeted smaller and medium-sized businesses that enabled other critical infrastructure.Andrew Scott, via techtargetAttributed
securityscorecard.com published its report on Nov 12, 2024.securityscorecard.comConfirmed

Could not verify

  • Whether the four confirmed campaigns resulted in a disclosed number of affected victims is not established
  • How many organizations were affected by the four confirmed campaigns is not established
  • Whether the four campaigns were linked to the earlier JDYFJ botnet is not established
cve
See all in Vulns & Patches →
Explore with AI
ChatGPT
Claude
Perplexity
Grok