Black Lotus Labs says its three-year Silent Train investigation confirmed exploitation of at least four previously unknown flaws in network and management systems, giving attackers administrative access and routes into customer networks.
Black Lotus Labs, communications company Lumen’s threat research division, says its three-year Silent Train investigation confirmed that Volt Typhoon exploited at least four zero-day vulnerabilities—previously unknown security flaws—in network-edge and management systems. The researchers’ findings also identify hundreds of victims and at least 27 classes of devices compromised to conceal the group’s attacks.
BleepingComputer’s 28 October report identifies Volt Typhoon as Chinese state-sponsored. The group previously targeted US communications, energy, transportation and water systems. CISA, the US cybersecurity agency, has warned that the group seeks access that could enable disruption during a future crisis or conflict. China’s government previously denied involvement and described Volt Typhoon as a US misinformation campaign.
Black Lotus Labs’ findings, shared with The Hacker News, identify hundreds of victims across telecommunications, government, defense contractors, satellite and mission-critical communications, universities, IT and critical infrastructure. Those infrastructure sectors include water, energy, transportation, maritime services, rail, aviation and emergency services. The account describes Silent Train as disrupted.
The researchers say at least 27 device classes were exploited and enrolled in the relay network. These ranged from small-office and home-office equipment and internet-connected devices to enterprise platforms. The devices carried attack traffic through several intermediate stops, making its origin harder for victims and defenders to trace.
The selected targets included systems that manage other devices and networks. Black Lotus Labs says taking over these centralized platforms gives attackers broad administrative control, enabling theft of login credentials, copying data out of networks and lasting remote access. That control can also expose customer networks without conspicuous movement between machines that might trigger security alerts. Managed service providers—businesses that administer customers’ systems—were among the targets.
The W27 keeps the Galaxy Z Fold 8 Ultra’s core hardware, with dark-red or dark-blue finishes, golden accents and 16GB of working memory in both storage versions.
2 min
Black Lotus Labs identifies four confirmed zero-day exploitation campaigns through Silent Train. One campaign involved two flaws in N-able N-central; the separate suspected Quest KACE campaign is not part of that confirmed count.
| Platform | Vulnerability | Finding |
|---|---|---|
| Cisco Catalyst SD-WAN Controller | CVE-2026-20127 | Confirmed zero-day campaign |
| Arista VeloCloud Orchestrator | CVE-2026-16812 | Confirmed zero-day campaign |
| N-able N-central | CVE-2025-8875 and CVE-2025-8876 | Confirmed zero-day campaign |
| Versa Director | CVE-2024-39717 | Confirmed zero-day campaign |
| Quest KACE | Suspected zero-day | Suspected exploitation, not confirmed |
The suspected Quest KACE exploitation preceded a patch in October 2025. That campaign is estimated to have affected more than 30 victims. In the confirmed Versa Director campaign, attackers used a file-upload flaw to deliver a web shell designed to harvest credentials and enable access to downstream customers.
Black Lotus Labs observed the most targeting in California, Texas and Hawaii, which it interprets as suggesting an Indo-Pacific focus. The researchers believe Silent Train was reserved for high-value targets and careful, hands-on operations conducted on China Standard Time; they regard the use of zero-days as supporting that assessment.
Silent Train’s sessions began on rented virtual servers outside the US. Traffic then passed through compromised devices outside the country before reaching compromised US devices that served as the final relay to domestic victims. Black Lotus Labs says those US exit points helped attackers evade restrictions based on location and lists of suspicious internet addresses.
Disposable-relay sessions typically lasted less than eight hours. The researchers’ findings put the average at about four hours, with some lasting only minutes. After a session, the attackers removed their tools, access keys and configuration files and dismantled the chain.
By early 2025, Black Lotus Labs observed a hybrid model: disposable relays operated alongside compromised enterprise systems retained for one to three months. Instead of replacing every device after each operation, the group kept some enterprise access available across operations while continuing to rotate the temporary relays.
The framework began taking shape around November 2023. In December 2023, the FBI disrupted KV-Botnet through a court-authorized operation announced in January 2024. That botnet used hundreds of compromised US routers to conceal Volt Typhoon’s hacking activity. Black Lotus Labs assesses that the disruption partly fueled Silent Train’s deployment and says its activity surged after a second disruption in late January 2024.
Cisco’s advisory, first issued on 25 February and updated on 16 June, says CVE-2026-20127 can let a remote attacker bypass authentication and gain administrative privileges. On a Controller, that access can allow changes to network configuration. Cisco says it is aware of limited exploitation.
The flaw affects Catalyst SD-WAN Controller, Manager and Validator regardless of configuration, across on-premises and Cisco-hosted cloud deployments, including Cisco-managed and FedRAMP environments. Cisco has released updates and says no workaround resolves the vulnerability.
Arista’s VeloCloud advisory, issued on 27 July and updated on 10 August, says CVE-2026-16812 is actively exploited. An attacker with network access to the web interface needs no tenant or operator credentials to reach privileged internal functions, potentially compromising the orchestrator and its managed data. On-premises and hosted Orchestrator deployments are affected; end-of-support software versions have not been assessed.
| Product and release branch | Vendor guidance |
|---|---|
| Cisco Catalyst SD-WAN 20.9 | First fixed release: 20.9.8.2 |
| Cisco Catalyst SD-WAN 20.15 | First fixed release: 20.15.4.2 |
| Cisco Catalyst SD-WAN 20.18 | First fixed release: 20.18.2.1 |
| VeloCloud Orchestrator 5.2 | Versions before 5.2.3.14 are affected; 5.2.3.14 and later in this branch contain the fix. |
| VeloCloud Orchestrator 6.1 | Versions before 6.1.3.4 are affected; 6.1.3.4 and later in this branch contain the fix. |
| VeloCloud Orchestrator 6.4 | Versions before 6.4.2.4 are affected; 6.4.2.4 and later in this branch contain the fix. |
| VeloCloud Orchestrator 7.0 | Arista lists versions before 7.0.0.1 as affected. |
Black Lotus Labs recommends restricting internet access to administrative interfaces, patching promptly, and keeping security logs centrally for longer. Operators should watch for unusual administrator activity and review trusted connections that could expose customer or partner networks.
For suspected Cisco compromise, the vendor recommends checking authentication logs and manually validating connections between control components against authorized activity. Customers should contact Cisco’s Technical Assistance Center for help assessing a possible breach.
Arista recommends preserving relevant logs before remediation where feasible. Because an Orchestrator compromise may also expose the devices it manages, incident response may include rotating credentials, reviewing administrator activity, checking managed-device configurations, and restoring or replacing affected orchestrators from trusted sources.
The satellite operator expects access to more than twice OneWeb’s current bandwidth in return for spending in 2027–2034, with initial IRIS² services expected from 2030.
3 min
The black, gold and green edition follows September’s sold-out preorders. Nintendo’s replenished launch-day stock also quickly sold out.
1 min
