Volt Typhoon targeted enterprise control planes via ever-changing “Silent Train” relay network
Volt Typhoon deploys Silent Train relay network using compromised devices to target US critical infrastructure control
Volt Typhoon, a Chinese state-sponsored APT group, has been leveraging a sophisticated, constantly rotating relay network called "Silent Train" comprised of compromised SOHO, IoT, and enterprise devices (TP-Link, Netgear, Fortinet, Cisco) to hide intrusions into US critical infrastructure. The group exploited multiple zero-day vulnerabilities in network and endpoint management systems, SD-WAN orchestrators, and control plane infrastructure including Versa Director, N-Able N-Central, Cisco Catalyst SD-WAN, VeloCloud, and Quest KACE, achieving significant operational benefits with minimal lateral movement and forensic artifacts. Black Lotus Labs revealed that Silent Train represents a departure from traditional botnet tactics, using transient, compartmentalized infrastructure across more than 27 device classes to maintain persistent, stealthy access.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Cisco?
Get an email when a new story names Cisco, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonVolt Typhoon's Silent Train campaign demonstrates how state-sponsored actors exploit zero-day vulnerabilities in widely deployed network management and control plane systems—such as Versa Director, Cisco SD-WAN, and Quest KACE—to gain persistent footholds with minimal forensic traces. By routing intrusions through a constantly rotating relay network of compromised SOHO, IoT, and enterprise devices, the group effectively masks its origin and evades traditional detection mechanisms. The use of transient, compartmentalized infrastructure across 27+ device classes highlights the critical failure of organizations to maintain visibility into and control over their network edge. This matters because control plane compromises can give attackers the ability to manipulate traffic, harvest credentials, and persist silently for months or years inside critical infrastructure.
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2024-39717
- cve — CVE-2025-8875
- cve — CVE-2025-8876
- cve — CVE-2026-20127
- cve — CVE-2026-16812
- malware — KeyDrift