Volt Typhoon used Silent Train network in four confirmed zero-day campaigns

Lumen’s Black Lotus Labs reported that the China-linked group Volt Typhoon used a covert network called Silent Train in four confirmed zero-day campaigns against software managing entire networks, including flaws disclosed from 2024 through 2026. Silent Train, first discovered in late 2023, linked compromised home-office routers, connected devices and enterprise systems, with sessions averaging about four hours before operators broke connections and erased evidence; activity increased after authorities dismantled Volt Typhoon’s earlier KV-botnet in early 2024. The campaigns involved Versa Director’s CVE-2024-39717, N-able N-central’s CVE-2025-8875 and CVE-2025-8876, Cisco’s CVE-2026-20127 and Arista’s CVE-2026-16812; all four vendors released fixes. Lumen observed continued exploitation of Cisco’s flaw after its disclosure.