# Volt Typhoon 'Silent Train' Relay Framework Used to Conceal Zero-Day Exploitation (CVE-2026-16812, CVE-2026-20127, CVE-2025-8875, CVE-2025-8876, CVE-2024-39717)

> China-nexus Volt Typhoon operates 'Silent Train', a semi-automated relay framework of rapidly rotating chains of compromised SOHO, IoT and enterprise devices that are torn down after each session, to conceal attacks on high-value management platforms. Black Lotus Labs (Lumen) ties it to exploitation of Arista VeloCloud Orchestrator, Cisco Catalyst SD-WAN, N-able N-central and Versa Director, plus a likely zero-day in Quest KACE.

- **Published:** 2026-10-28T18:55:10Z
- **Last reviewed:** 2026-10-28T23:31:38.706Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4665
- **ID:** TL-2026-4665
- **Severity:** HIGH (CVSS 10)
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Volt Typhoon - G1017 (China)
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-16812, CVE-2026-20127, CVE-2025-8875, CVE-2025-8876, CVE-2024-39717

## Description

Black Lotus Labs (Lumen) documents Silent Train as Volt Typhoon's operational relay framework, observed from November 2023 through July 2026. Sessions are routed through 4-6 hops: a temporary non-U.S. VPS, a second VPS for provider diversity, compromised non-U.S. SOHO/IoT devices across several countries, and finally a compromised U.S.-based device acting as the exit point toward the victim. Operators could exploit and assemble a chain of devices in under two minutes. Device classes are compartmentalized by role (Intelbras modems only as overseas relays, Netgear Orbi only as U.S. hops) and VPS instances are not shared across chains. More than 27 device types were identified, including TP-Link, Netgear Orbi, Intelbras, Ruckus, SATO, Zyxel and Cambium devices, and enterprise platforms such as Fortinet FortiGate, Cisco, PRTG, Mirth Connect, CyberPanel and ManageEngine.

Silent Train was already in use before the KV-botnet was disrupted by the U.S. government, and adoption accelerated afterwards, with roughly one new device type added per month during the build-out. By early 2025 the operators moved to a hybrid model that keeps longer-lived enterprise-platform hops (1-3 months) alongside disposable relays. Chains are built with native SSH chaining plus open-source Chisel and FRP reverse-tunnel proxies. Sessions average about 4 hours (minutes to 10+ hours), follow Monday-Friday 09:00-22:00 China Standard Time, show multi-week pauses around Chinese New Year, and end with removal of all artifacts and dismantling of the chain. Operators deploy only the tooling needed to enable chained SSH access, rely on temporary SSH services and living-off-the-land utilities, and in some cases altered or erased logs. Observed ports include SSH 22, 2222, 8103 and 14737, HTTPS 443 and 8443, HTTP 8281, and 8999 for Chisel TCP reverse tunnels.

The relay network concealed exploitation of centralized management and control-plane products: Versa Director (CVE-2024-39717, mid-2024, in-memory JAR webshell), N-able N-central (CVE-2025-8875 and CVE-2025-8876, 2025), Quest KACE (likely zero-day, 30+ victims, remediated in October 2025 updates, in-memory webshell), Cisco Catalyst SD-WAN (CVE-2026-20127, CVSS 10.0, exploitation continued after the February 2026 disclosure) and Arista VeloCloud Orchestrator (CVE-2026-16812, CVSS 10.0 OS command injection, published July 2026, confirmed exploited). After compromise, operators abused native platform features for credential harvesting, endpoint control and remote file transfer. Victimology covers telecommunications, U.S. government, defense contractors and the cleared defense industrial base, satellite communications, universities with ROTC/defense ties, MSPs and IT providers, and critical infrastructure (water, energy, transportation, maritime, rail, aviation, emergency services), concentrated in Hawaii, California and Texas, which Black Lotus Labs links to Indo-Pacific military and logistics interests. The report publishes no IP addresses, domains or hashes; the IOCs below are tooling, port and device-class indicators for hunting rather than fixed infrastructure.

## MITRE ATT&CK

- T1583.003 Virtual Private Server
- T1584.008 Network Devices
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1505.003 Web Shell
- T1021.004 SSH
- T1090.003 Multi-hop Proxy
- T1572 Protocol Tunneling
- T1070 Indicator Removal
- T1070.004 Indicator Removal
- T1665 Hide Infrastructure
- T1105 Ingress Tool Transfer
- T1199 Trusted Relationship
- T1078 Valid Accounts
- T1098.004 Account Manipulation: SSH Authorized Keys

## Sources

- [Volt Typhoon hides zero-day attacks using 'Silent Train' framework](https://www.bleepingcomputer.com/news/security/volt-typhoon-hides-zero-day-attacks-using-silent-train-framework/)
- [Silent Train: Volt Typhoon Operational Framework (Black Lotus Labs, Lumen)](https://www.lumen.com/blog/en-us/silent-train-volt-typhoon-operational-framework)
- [NVD - CVE-2026-20127 (Cisco Catalyst SD-WAN authentication bypass)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-20127)
- [Cisco Security Advisory cisco-sa-sdwan-rpa-EHchtZk](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk)
- [NVD - CVE-2026-16812 (VeloCloud Orchestrator command injection)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-16812)
- [Arista Security Advisory 0144](https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144)
- [NVD - CVE-2025-8875 (N-able N-central deserialization)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-8875)
- [NVD - CVE-2025-8876 (N-able N-central command injection)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-8876)
- [N-able: Announcing the GA of N-central 2025.3.1](https://status.n-able.com/2025/08/13/announcing-the-ga-of-n-central-2025-3-1/)
- [NVD - CVE-2024-39717 (Versa Director favicon upload)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2024-39717)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Stealthy KV-Botnet hijacks SOHO routers and VPN devices (BleepingComputer)](https://www.bleepingcomputer.com/news/security/stealthy-kv-botnet-hijacks-soho-routers-and-vpn-devices/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4665