Lumen Links Volt Typhoon to Four Silent Train Zero-Day Campaigns

Lumen’s Black Lotus Labs tied four zero-day campaigns targeting network and device-management platforms to Volt Typhoon, describing a relay framework that could expose systems administered across organizations and their customers.

The campaigns targeted Versa Director, N-able N-central, Cisco Catalyst SD-WAN and VeloCloud Orchestrator. The cases involved five vulnerabilities: CVE-2024-39717 in Versa Director; CVE-2025-8875 and CVE-2025-8876 in N-central; CVE-2026-20127 in Cisco’s SD-WAN platform; and CVE-2026-16812 in VeloCloud Orchestrator. The two N-central flaws were part of one campaign.

Silent Train rotated activity through compromised small-office/ -office routers, internet of things (IoT) devices and enterprise equipment. Operators dismantled relay chains and removed artifacts after operations. Researchers observed more than 27 device classes. Consistent activity dates to November 2023; Lumen tracked the framework for more than three years, with hundreds of victim notifications sent.

These platforms give administrators visibility into and control over systems used by organizations and their customers. Access through a management tool can offer broad reach across connected assets, reducing the need for an attacker to move through a victim’s network one machine at a time.

N-able fixed both N-central flaws in version 2025.3.1, and exploiting them required authentication. CVE-2026-20127 carries a 10.0 rating on the Common Vulnerability Scoring System (CVSS), and software updates were available. Cisco updated its advisory at 5:54 p.m. ET on Oct. 28 (21:54 UTC), saying it was aware of limited exploitation; the update did not name Volt Typhoon. CVE-2026-16812 also carries a 10.0 CVSS rating and was actively exploited.

A separate campaign against Quest KACE affected more than 30 victims. Lumen assessed its zero-day status as likely, with moderate confidence because forensic evidence was limited; it is not counted among the four confirmed zero-day campaigns.

The mapped activity ran from November 2023 through July 2026, with Hawaii, California and Texas the most targeted U.S. regions. Victim sectors included telecommunications, government, defense, satellite communications, universities, managed service providers and critical infrastructure.

In February 2024, the Cybersecurity and Infrastructure Security Agency (CISA) said U.S. agencies assessed that Volt Typhoon was seeking to position itself on U.S. infrastructure networks for disruptive or destructive activity during a future crisis or conflict. That assessment addressed a broader threat and did not establish an imminent attack tied to the Silent Train campaigns.