Volt

2026

Four

Lotus

Lumen’s Black Lotus Labs researchers revealed that China-linked hacking group Volt Typhoon used a covert network called <a href="https://www.lumen.com/blog/en-us/silent-train-volt-typhoon-operational-framework" rel="noopener noreferrer nofollow">Silent Train</a> in four confirmed zero-day campaigns.
The hackers targeted platforms that manage entire networks, not just individual computers. Compromising one of these systems could give them access to telecommunications, defense, and other critical infrastructure networks.
The researchers warned:
<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">
 “Systems with broad administrative reach can become high-value gateways to the entire organization and its customers.”
</blockquote>
<h3 class="wp-block-heading" id="strong-a-disposable-network-built-to-disappear-strong">A disposable network built to disappear</h3>
Silent Train was designed to leave little trace. Its operators linked compromised home-office routers, connected devices, and enterprise systems to carry out attacks. Once an operation ended, they broke those connections and erased evidence of their activity. Sessions lasted about four hours on average.
Silent Train was <a href="https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/" rel="noopener noreferrer nofollow">first discovered</a> in the latter part of 2023. Its activity increased after authorities <a href="https://www.lumen.com/blog/en-us/silent-train-volt-typhoon-operational-framework" rel="noopener noreferrer nofollow">dismantled the earlier KV-botnet of Volt Typhoon</a> in the early part of 2024.
Black Lotus Labs sent out thousands of victim notifications over the course of three years. Among the industries affected by the hacking group are telecommunications, defense, satellite communications, energy, transportation, and the water resources sector. They showed special interest in targets that were located in Hawaii, Texas, and California.
<h3 class="wp-block-heading" id="strong-four-campaigns-five-cves-strong">Four campaigns, five CVEs</h3>
Silent Train’s four confirmed campaigns targeted software used to manage entire networks.
The first involved <a href="https://versa-networks.com/blog/versa-security-bulletin-update-on-cve-2024-39717-versa-director-dangerous-file-type-upload-vulnerability" rel="noopener noreferrer nofollow">Versa Director</a>, where CVE-2024-39717 allowed attackers with privileged access to upload malicious files. Versa disclosed the flaw in August 2024.
In 2025, attackers targeted <a href="https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2025.3.1_Release_Notes.htm" rel="noopener noreferrer nofollow">N-able N-central</a> through two vulnerabilities, CVE-2025-8875 and CVE-2025-8876. Both required authentication.
The 2026 campaigns involved two SD-WAN management platforms. <a href="https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-sdwan-rpa-EHchtZk.html" rel="noopener noreferrer nofollow">Cisco</a> disclosed CVE-2026-20127 on February 25. Rated 10.0, the flaw allowed attackers to gain administrative privileges without authentication. <a href="https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144" rel="noopener noreferrer nofollow">Arista</a> disclosed another 10.0-rated vulnerability, CVE-2026-16812, affecting VeloCloud Orchestrator on July 27.
All four vendors released fixes. However, Lumen observed continued exploitation of Cisco’s vulnerability after its disclosure.
<figure class="wp-block-image size-full"><img width="1672" height="941" src="https://www.cryptopolitan.com/wp-content/uploads/2026/10/Volt-Typhoon-zero-day-campaign-atlas-1.png" alt="">
 <figcaption>Volt Typhoon’s Silent Train: Four Zero-Day Campaigns and Cybersecurity Market Risks
 </figcaption>
</figure>
<h3 class="wp-block-heading" id="strong-why-access-is-the-point-strong">Why access is the point</h3>
Volt Typhoon’s activities go back to at least mid-2021. <a href="https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/" rel="noopener noreferrer nofollow">Microsoft</a> publicly identified the group in May 2023, reporting intrusions into critical infrastructure networks in Guam and the continental United States.
The concern goes beyond stolen information.
In a January 2026 <a href="https://www.iiss.org/online-analysis/cyber-power-matrix/2026/01/volt-typhoons-long-shadow/" rel="noopener noreferrer nofollow">analysis</a>, IISS researcher John Bruce observed:
The vast majority of the networks targeted by Volt Typhoon offered little foreign intelligence value to the Chinese government.
Bruce pointed to the group’s collection of network diagrams and operating manuals as evidence of preparations for possible disruption. Guam is particularly sensitive because its military facilities would be important in a potential conflict over Taiwan.
These remain assessments of the group’s intentions, not proof of an ordered attack.
<h3 class="wp-block-heading" id="strong-concentration-is-the-exposure-strong">Concentration is the exposure</h3>
The broader cybersecurity picture helps explain the danger.
<a href="https://www.verizon.com/business/resources/executivebriefs/2026-dbir-executive-summary.pdf" rel="noopener noreferrer nofollow">Verizon’s 2026 report</a>, covering more than 31,000 incidents, found that vulnerability exploitation had become the leading route into organizations. System intrusion accounted for 61% of confirmed breaches.
When attackers compromise software managing multiple networks, the potential damage extends beyond one organization.
The financial implications remain uncertain. The <a href="https://www.imf.org/en/blogs/articles/2026/10/12/global-financial-markets-face-rising-risks-from-ai-bond-yields-and-cyberattacks" rel="noopener noreferrer nofollow">IMF</a> has warned that interconnected financial systems face growing cyber risks. However, no market losses have been directly attributed to Silent Train.
Separately, <a href="https://www.cryptopolitan.com/arista-patches-exploited-velocloud-zero-day-as-sd-wan-risks-mount/" rel="noopener noreferrer nofollow">Cryptopolitan reported</a> another exploited VeloCloud vulnerability, CVE-2026-114625, rated 9.9 and patched on October 22. It is distinct from the flaw Lumen linked to Silent Train.
The smartest crypto minds already read our newsletter. Want in? <a href="https://www.cryptopolitan.com/newsletters/?utm_source=cp&amp;utm_medium=web&amp;utm_campaign=inlineAds" rel="noopener noreferrer nofollow">Join them</a>.

Volt Typhoon used Silent Train network in four confirmed zero-day campaigns

Table of Contents

Cryptopolitan_News

Other articles published on Oct 29, 2026

Join our free newsletter for daily crypto updates!