Threat reportAPTTL-2026-4665
Volt Typhoon 'Silent Train' Relay Framework Used to Conceal Zero-Day Exploitation (CVE-2026-16812, CVE-2026-20127, CVE-2025-8875, CVE-2025-8876, CVE-2024-39717)
Volt Typhoon 'Silent Train' Relay Framework Used to Conceal (TL-2026-4665), also tracked as Silent Train, is a high-severity advanced persistent threat campaign scored CVSS 10, first published 2026-10-28. It is attributed to Volt Typhoon - G1017 (China) with high confidence, affects Arista VeloCloud Orchestrator (on-prem), references 5 CVEs (CVE-2026-16812, CVE-2026-20127, CVE-2025-8875), maps to 8 MITRE ATT&CK techniques (T1021.004, T1059, T1090.003), and is covered by 9 detection rules and 8 indicators of compromise.
- CVSS
- 10/10High
- CVEs
- 5Referenced vulnerabilities
- Techniques
- 8MITRE ATT&CK
- Actors
- 1Volt Typhoon - G1017
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-4665
- Threat ID
- TL-2026-4665
- Also known as
- Silent Train, KV-botnet successor relay network
- Severity
- HIGH
- CVSS
- 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- APT
- First published
- Last reviewed
- Attribution
- Volt Typhoon - G1017
- Attribution confidence
- HIGH
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- telecoms, government administration, defense, satellite-communications, education, managed-service-providers, utilities, water, energy, transport, maritime, aviation
- Target regions
- united states of america, Hawaii, California, Texas, Indo-Pacific
- Detection rules
- 9
- Indicators of compromise
- 8
Malware and tooling in Volt Typhoon 'Silent Train' Relay Framework Used to Conceal
Malware and tooling: KV-botnet, Chisel, FRP - S1144
How Volt Typhoon 'Silent Train' Relay Framework Used to Conceal works
China-nexus Volt Typhoon operates 'Silent Train', a semi-automated relay framework of rapidly rotating chains of compromised SOHO, IoT and enterprise devices that are torn down after each session, to conceal attacks on high-value management platforms. Black Lotus Labs (Lumen) ties it to exploitation of Arista VeloCloud Orchestrator, Cisco Catalyst SD-WAN, N-able N-central and Versa Director, plus a likely zero-day in Quest KACE.
Black Lotus Labs (Lumen) documents Silent Train as Volt Typhoon's operational relay framework, observed from November 2023 through July 2026. Sessions are routed through 4-6 hops: a temporary non-U.S. VPS, a second VPS for provider diversity, compromised non-U.S. SOHO/IoT devices across several countries, and finally a compromised U.S.-based device acting as the exit point toward the victim. Operators could exploit and assemble a chain of devices in under two minutes. Device classes are compartmentalized by role (Intelbras modems only as overseas relays, Netgear Orbi only as U.S. hops) and VPS instances are not shared across chains. More than 27 device types were identified, including TP-Link, Netgear Orbi, Intelbras, Ruckus, SATO, Zyxel and Cambium devices, and enterprise platforms such as Fortinet FortiGate, Cisco, PRTG, Mirth Connect, CyberPanel and ManageEngine.
Silent Train was already in use before the KV-botnet was disrupted by the U.S. government, and adoption accelerated afterwards, with roughly one new device type added per month during the build-out. By early 2025 the operators moved to a hybrid model that keeps longer-lived enterprise-platform hops (1-3 months) alongside disposable relays. Chains are built with native SSH chaining plus open-source Chisel and FRP reverse-tunnel proxies. Sessions average about 4 hours (minutes to 10+ hours), follow Monday-Friday 09:00-22:00 China Standard Time, show multi-week pauses around Chinese New Year, and end with removal of all artifacts and dismantling of the chain. Operators deploy only the tooling needed to enable chained SSH access, rely on temporary SSH services and living-off-the-land utilities, and in some cases altered or erased logs. Observed ports include SSH 22, 2222, 8103 and 14737, HTTPS 443 and 8443, HTTP 8281, and 8999 for Chisel TCP reverse tunnels.
The relay network concealed exploitation of centralized management and control-plane products: Versa Director (CVE-2024-39717, mid-2024, in-memory JAR webshell), N-able N-central (CVE-2025-8875 and CVE-2025-8876, 2025), Quest KACE (likely zero-day, 30+ victims, remediated in October 2025 updates, in-memory webshell), Cisco Catalyst SD-WAN (CVE-2026-20127, CVSS 10.0, exploitation continued after the February 2026 disclosure) and Arista VeloCloud Orchestrator (CVE-2026-16812, CVSS 10.0 OS command injection, published July 2026, confirmed exploited). After compromise, operators abused native platform features for credential harvesting, endpoint control and remote file transfer. Victimology covers telecommunications, U.S. government, defense contractors and the cleared defense industrial base, satellite communications, universities with ROTC/defense ties, MSPs and IT providers, and critical infrastructure (water, energy, transportation, maritime, rail, aviation, emergency services), concentrated in Hawaii, California and Texas, which Black Lotus Labs links to Indo-Pacific military and logistics interests. The report publishes no IP addresses, domains or hashes; the IOCs below are tooling, port and device-class indicators for hunting rather than fixed infrastructure.
MITRE ATT&CK techniques used in TL-2026-4665
Lateral Movement
Execution
T1059 Command and Scripting Interpreter
Command and Control
T1090.003 Multi-hop Proxy; T1572 Protocol Tunneling
Initial Access
T1190 Exploit Public-Facing Application
Persistence
Resource Development
Affected products and versions in Volt Typhoon 'Silent Train' Relay Framework Used to Conceal
- Arista — VeloCloud Orchestrator (on-prem)
Vulnerable versions: 5.2.0-5.2.3.13; 6.1.0-6.1.3.3; 6.4.0-6.4.2.3; 7.0.0
Fixed in: 5.2.3.14; 6.1.3.4; 6.4.2.4; 7.0.0.1 - Cisco — Catalyst SD-WAN Manager, vSmart Controller, vBond Orchestrator
Vulnerable versions: before 20.9.8.2; 20.11-20.12.5.2; 20.13-20.15.4.1; 20.16-20.18.2; 20.12.6
Fixed in: see Cisco advisory cisco-sa-sdwan-rpa-EHchtZk - N-able — N-central
Vulnerable versions: before 2025.3.1
Fixed in: 2025.3.1 - Versa Networks — Versa Director
Vulnerable versions: 21.2.2; 21.2.3 (before 2024-06-21); 22.1.1; 22.1.2 (before 2024-06-21); 22.1.3 (before 2024-06-21)
Fixed in: builds from 2024-06-21 onward - Quest — KACE (suspected zero-day, CVE not assigned in sources)
Vulnerable versions: pre-October 2025 releases
Fixed in: October 2025 updates
Remediation for Volt Typhoon 'Silent Train' Relay Framework Used to Conceal
Patches
- Cisco Catalyst SD-WAN: apply fixed releases per cisco-sa-sdwan-rpa-EHchtZk (CVE-2026-20127)
- Arista VeloCloud Orchestrator: upgrade to 5.2.3.14, 6.1.3.4, 6.4.2.4 or 7.0.0.1 or later (CVE-2026-16812)
- N-able N-central: upgrade to 2025.3.1 or later (CVE-2025-8875, CVE-2025-8876)
- Versa Director: apply the vendor fix for CVE-2024-39717
- Quest KACE: apply the October 2025 updates
Immediate actions
- Restrict administrative interfaces of SD-WAN, RMM and endpoint-management platforms to VPNs, jump hosts or dedicated management networks
- Inventory and minimize internet-facing administrative services
- Hunt for anomalous administrative logins, API usage and configuration changes outside normal workflows, especially outside business hours
- Review SSH listeners on non-standard ports (2222, 8103, 14737) and Chisel/FRP artifacts on edge and management devices
Workarounds
- Disable or firewall the Versa Director favicon upload function and management ports from untrusted networks until patched
- Replace or isolate end-of-life SOHO/IoT devices that can serve as relay hops
Longer-term hardening
- Centralize logging with extended retention for internet-facing systems
- Treat centralized management systems as priority nation-state targets and assess downstream trust relationships
- Follow CISA and NCSC guidance for mitigating Volt Typhoon activity and CISA advisory AA26-113A
CVEs associated with Volt Typhoon 'Silent Train' Relay Framework Used to Conceal
CVE-2026-16812, CVE-2026-20127, CVE-2025-8875, CVE-2025-8876, CVE-2024-39717
Weaknesses (CWE) in Volt Typhoon 'Silent Train' Relay Framework Used to Conceal
Timeline of Volt Typhoon 'Silent Train' Relay Framework Used to Conceal
- Black Lotus Labs begins consistently observing Silent Train relay activity, before the KV-botnet disruption
- U.S. government disrupts the KV-botnet; Silent Train adoption accelerates with roughly one new device type added per month
- CVE-2024-39717 (Versa Director favicon upload) published after mid-2024 in-memory JAR webshell exploitation
- By early 2025 operators shift to a hybrid model adding longer-lived (1-3 month) enterprise-platform relay hops
- CVE-2025-8875 and CVE-2025-8876 (N-able N-central) added to CISA KEV; fixed in N-central 2025.3.1
- Quest KACE flaw, likely a zero-day affecting 30+ victims, remediated in October 2025 updates
- CVE-2026-20127 (Cisco Catalyst SD-WAN authentication bypass, CVSS 10.0) published; exploitation continued after disclosure
- CVE-2026-16812 (Arista VeloCloud Orchestrator OS command injection, CVSS 10.0) published with confirmed active exploitation
- Lumen Black Lotus Labs report on Silent Train covered by BleepingComputer; observation window Nov 2023-Jul 2026
Sources cited for Volt Typhoon 'Silent Train' Relay Framework Used to Conceal
- Volt Typhoon hides zero-day attacks using 'Silent Train' framework
- Silent Train: Volt Typhoon Operational Framework (Black Lotus Labs, Lumen)
- NVD - CVE-2026-20127 (Cisco Catalyst SD-WAN authentication bypass)
- Cisco Security Advisory cisco-sa-sdwan-rpa-EHchtZk
- NVD - CVE-2026-16812 (VeloCloud Orchestrator command injection)
- Arista Security Advisory 0144
- NVD - CVE-2025-8875 (N-able N-central deserialization)
- NVD - CVE-2025-8876 (N-able N-central command injection)
- N-able: Announcing the GA of N-central 2025.3.1
- NVD - CVE-2024-39717 (Versa Director favicon upload)
- CISA Known Exploited Vulnerabilities Catalog
- Stealthy KV-Botnet hijacks SOHO routers and VPN devices (BleepingComputer)
Detection coverage for TL-2026-4665
As of 2026-10-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4665 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.