[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fdYXZpxHpqjd1v_KcozsUyjFWMocKd4PPgJnU8BmK89I":3},{"article":4,"iocs":58,"watch_terms":78,"solutions":79,"lesson":179},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"39bef7bd-8c5c-458d-9659-ce9381646782","Volt Typhoon targeted enterprise control planes via ever-changing “Silent Train” relay network","volt-typhoon-targeted-enterprise-control-planes-via-ever-changing-silent-train-r-7b3ca4","Volt Typhoon, a Chinese state-sponsored APT group that’s focused on cyberespionage and United States’ critical infrastructure, has been using a covert, constantly rotating relay network to hide its most sensitive intrusions, Lumen’s Black Lotus Labs revealed on Wednesday. This network, dubbed Silent Train by the researchers, consists of chains of compromised SOHO and IoT devices (e.g., TP-Link and Netgear routers) and enterprise systems (e.g., Fortinet and Cisco appliances, PRTG and CyberPanel servers). Through it, the … More → The post Volt Typhoon targeted enterprise control planes via ever-changing “Silent Train” relay network appeared first on Help Net Security.","Volt Typhoon, a Chinese state-sponsored APT group, has been leveraging a sophisticated, constantly rotating relay network called \"Silent Train\" comprised of compromised SOHO, IoT, and enterprise devices (TP-Link, Netgear, Fortinet, Cisco) to hide intrusions into US critical infrastructure. The group exploited multiple zero-day vulnerabilities in network and endpoint management systems, SD-WAN orchestrators, and control plane infrastructure including Versa Director, N-Able N-Central, Cisco Catalyst SD-WAN, VeloCloud, and Quest KACE, achieving significant operational benefits with minimal lateral movement and forensic artifacts. Black Lotus Labs revealed that Silent Train represents a departure from traditional botnet tactics, using transient, compartmentalized infrastructure across more than 27 device classes to maintain persistent, stealthy access.","Volt Typhoon deploys Silent Train relay network using compromised devices to target US critical infrastructure control","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F10\u002F29\u002Fvolt-typhoon-silent-train-relay-network\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2024\u002F07\u002F09132937\u002Fchina.webp","2026-10-29T13:42:13+00:00","2026-10-29T14:00:15.120301+00:00",9,[17,20,22,25,28,30],{"name":18,"type":19},"Volt Typhoon","threat_actor",{"name":21,"type":19},"UAT-11473",{"name":23,"type":24},"Silent Train","campaign",{"name":26,"type":27},"Lumen","vendor",{"name":29,"type":27},"Cisco",{"name":31,"type":27},"Fortinet","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":32,"icon":34,"name":35,"slug":36},null,"Nation-state","nation-state",[38,43,48,53],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":54},{"id":55,"icon":34,"name":56,"slug":57},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[59,63,66,68,71,74],{"type":60,"value":61,"context":62},"cve","CVE-2024-39717","Versa Director exploitation by Volt Typhoon via Silent Train",{"type":60,"value":64,"context":65},"CVE-2025-8875","N-Able N-Central exploitation by Volt Typhoon",{"type":60,"value":67,"context":65},"CVE-2025-8876",{"type":60,"value":69,"context":70},"CVE-2026-20127","Cisco Catalyst SD-WAN exploitation by Volt Typhoon and UAT-11473",{"type":60,"value":72,"context":73},"CVE-2026-16812","VeloCloud Orchestrator exploitation by Volt Typhoon",{"type":75,"value":76,"context":77},"malware","KeyDrift","Custom malware framework deployed by UAT-11473 on Cisco SD-WAN Catalyst Controllers for persistent access and data exfiltration",[29,31,26],{"controls":80,"vendors":168},[81,110,139],{"slug":82,"name":83,"problem":84,"products":85},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"slug":111,"name":112,"problem":113,"products":114},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[115,123,131],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":140,"name":141,"problem":142,"products":143},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[144,152,160],{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":153,"vendor_name":154,"vendor_logo":155,"product_slug":156,"product_name":157,"url":158,"description":159},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":161,"vendor_name":162,"vendor_logo":163,"product_slug":164,"product_name":165,"url":166,"description":167},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",[169,175],{"slug":170,"name":29,"logo_path":171,"roles":172},"cisco","\u002Fvendor-logos\u002Fcisco.png",[173,174],"reported_by","affected",{"slug":176,"name":31,"logo_path":177,"roles":178},"fortinet","\u002Fvendor-logos\u002Ffortinet.png",[174],{"slug":180,"title":181,"body":182,"framework_refs":183,"framework_notes":191},"volt-typhoons-silent-train-exploits-unpatched-control-plane-devices-to-infiltrate-critical-infrastru","Volt Typhoon's Silent Train Exploits Unpatched Control Plane Devices to Infiltrate Critical Infrastructure","Volt Typhoon's Silent Train campaign demonstrates how state-sponsored actors exploit zero-day vulnerabilities in widely deployed network management and control plane systems—such as Versa Director, Cisco SD-WAN, and Quest KACE—to gain persistent footholds with minimal forensic traces. By routing intrusions through a constantly rotating relay network of compromised SOHO, IoT, and enterprise devices, the group effectively masks its origin and evades traditional detection mechanisms. The use of transient, compartmentalized infrastructure across 27+ device classes highlights the critical failure of organizations to maintain visibility into and control over their network edge. This matters because control plane compromises can give attackers the ability to manipulate traffic, harvest credentials, and persist silently for months or years inside critical infrastructure.",[184,185,186,187,188,189,190],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1090: Proxy","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":192,"MITRE ATT&CK T1090: Proxy":193,"NIST SP 800-53 SI-2: Flaw Remediation":194,"CIS Control 12: Network Infrastructure Management":195,"CIS Control 7: Continuous Vulnerability Management":196,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":197,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":198},"NIS2 requires operators of critical infrastructure to implement incident handling and vulnerability management measures; the scale of Silent Train's infiltration into US critical infrastructure underscores the need for mandated controls on securing and monitoring network management systems.","Silent Train is a textbook implementation of multi-hop proxy infrastructure using compromised devices; detection strategies mapped to T1090 (identifying anomalous relay chains and unusual traffic routing) would help defenders recognize and disrupt this obfuscation technique.","SI-2 requires organizations to identify, report, and correct information system flaws promptly; timely remediation of the zero-days exploited in SD-WAN orchestrators and RMM tools would have denied Volt Typhoon its initial access vectors.","The relay network leveraged compromised SOHO and enterprise network devices; rigorous hardening, patching, and lifecycle management of network infrastructure would have reduced the pool of devices available for Silent Train's rotating relay nodes.","Volt Typhoon exploited multiple zero-days and known vulnerabilities in management systems; a mature vulnerability management program with continuous scanning and enforced patch SLAs would have reduced the attack surface across affected platforms like Versa Director and Quest KACE.","This control mandates systematic identification and remediation of technical vulnerabilities in a timely manner, which would have directly addressed the unpatched zero-days in network orchestration and endpoint management systems exploited by Volt Typhoon.","Control plane systems were accessed with minimal resistance; enforcing least-privilege access, MFA, and strict authentication policies on management interfaces would have limited the group's ability to achieve persistent administrative access."]