Relay Networks and Zero-Days: Volt Typhoon’s Silent Train Campaign Against Critical Infrastructure

Publication date: October 29, 2026
Category: Threat Intelligence / Zero Days / Cyber Espionage

Introduction

Threat intelligence research has brought to light a sophisticated covert network dubbed Silent Train, operated by the China-linked state-sponsored actor known as Volt Typhoon. Over a three-year period, this clandestine infrastructure was specifically engineered to conceal the exploitation of unknown software flaws (zero-days) in centralized management platforms relied upon by organizations to administer devices, networks, and critical operations. By leveraging rapidly shifting chains of compromised home routers and rented servers, the group successfully bypassed IP reputation filters and geographic blocks, impacting key sectors including telecommunications, government agencies, energy, and critical infrastructure.

What is Silent Train and the Impact of Management Platforms? (General Analysis)

Silent Train is not an isolated piece of malware, but rather a highly disciplined command-and-control (C2) and traffic-relay operational architecture. First surfaced in late 2023 following the disruption of the KV botnet, this network relies on ephemeral infrastructure where operators quickly discard relay nodes and build fresh chains within minutes, heavily frustrating real-time attribution and traditional forensic investigations.

Volt Typhoon’s strategic objective via Silent Train has been pre-positioning within critical networks (with a heavy geographical concentration in regions like Hawaii, California, and Texas). To achieve this, the group systematically targeted tools with broad administrative reach—such as SD-WAN systems, endpoint management platforms, and cloud orchestrators—enabling them to manage thousands of downstream devices without engaging in noisy, conventional lateral movement.

Confirmed vulnerabilities exploited by this actor, which now populate the CISA Known Exploited Vulnerabilities (KEV) catalog, include:

  • CVE-2025-8875 (N-able N-central): Deserialization of untrusted data vulnerability allowing local/remote code execution (CVSS v4.0: 9.4 CRITICAL | CWE-502).
  • CVE-2025-8876 (N-able N-central): Improper input validation vulnerability allowing OS command injection (CVSS v4.0: 9.4 CRITICAL | CWE-20, CWE-78).
  • CVE-2026-20127 (Cisco Catalyst SD-WAN Controller/vSmart/vManage/vBond): Peering authentication flaw allowing an unauthenticated remote attacker to bypass controls and obtain internal administrative privileges (CVSS v3.1: 10.0 CRITICAL | CWE-287).
  • CVE-2026-16812 (VeloCloud Orchestrator on-prem): Exposure of privileged internal functionality allowing a remote attacker to access the host and compromise confidentiality, integrity, and availability (CVSS v4.0: 10.0 CRITICAL | CWE-78).

How Does It Work? (Technical Analysis)

The technical execution of the campaign spans dynamic network routing flows and precise exploit deployment against target management platforms:

  • Network Flow and Evasions (Relay Chains): Each operational session originated on a rented server outside the United States. Traffic was then routed through intermediary servers, compromised small-office/home-office (SOHO) routers (TP-Link, Netgear Orbi), and IoT devices in other countries, terminating at a compromised device in the U.S. close to the target. On average, traffic traversed four to six hops, masquerading as legitimate local traffic to bypass geolocation-based mitigation controls.
  • Operational Discipline and Automation: Sessions typically lasted around four hours (some only minutes). Operators utilized native system tools, temporary SSH keys, and open-source proxy tools such as Chisel and FRP to establish reverse tunnels. The relay infrastructure could be reconstructed in under two minutes, indicating partial automation.
  • Zero-Day Exploitation and Post-Exploitation: During critical stages, the group deployed zero-day exploits against Versa Director (leveraging memory-resident JAR webshells to limit forensic artifacts), N-able N-central, Cisco Catalyst SD-WAN, VeloCloud Orchestrator, and likely Quest KACE. Following compromise, they leveraged built-in administrative features to harvest credentials, wipe OS logs, and maintain persistence without leaving persistent disk footprints.

Affected Systems / Environments

The campaign impacted a diverse range of enterprise management appliances, networking hardware, and organizations across strategic sectors:

  • Networking and SOHO Hardware: TP-Link routers, Netgear Orbi systems, Intelbras modems, and Fortinet security appliances.
  • Management & SD-WAN Platforms: N-able N-central (versions prior to 2025.3.1), Cisco Catalyst SD-WAN Controller (vSmart, vManage, vBond), on-premises VeloCloud Orchestrator, Versa Director, and Quest KACE.
  • Impacted Sectors: Telecommunications, government agencies, defense contractors, satellite and emergency communications, universities with ROTC programs, managed service and IT providers (MSPs), and critical infrastructure (water, energy, transportation, maritime, rail, and aviation).
CVE Category (CWE) Impact CVSS Vector (summary)
CVE-2025-8875 CWE-502 (Deserialization) Code Execution 9.4 (Critical) CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H
CVE-2025-8876 CWE-20 / CWE-78 (Command Inj.) OS Command Execution 9.4 (Critical) CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H
CVE-2026-20127 CWE-287 (Improper Auth) Auth Bypass / Admin Priv. 10.0 (Critical) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVE-2026-16812 CWE-78 (OS Command / Priv. Func.) Complete Orchestrator Compromise 10.0 (Critical) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H

Mitigation and Detection

Remediation

  • Immediate Patching: Promptly apply vendor security updates for N-able N-central (upgrade to 2025.3.1 or later), Cisco SD-WAN, VeloCloud Orchestrator, and Quest KACE.
  • Attack Surface Reduction: Isolate administrative and management interfaces of critical platforms, restricting access strictly to internal management networks or hardened corporate VPNs secured with multi-factor authentication (MFA).
  • SOHO Device Hardening: Regularly update and patch peripheral networking equipment and office routers that risk being co-opted as relay nodes.

Detection

  • Tunneling and Proxy Monitoring: Audit for unauthorized usage of tunneling utilities such as Chisel or FRP, alongside sudden spinning up of ephemeral SSH services.
  • Memory Forensics: Inspect systems for memory-resident webshells (particularly Java JAR artifacts) and systematic clearing of operating system audit logs.

vg

“Systems with broad administrative reach represent high-value gateways to the entire organization and its customers. Reducing internet exposure, accelerating patching, and preserving security telemetry are essential to detecting threats earlier.”

Wrapping Up

The Silent Train campaign demonstrated Volt Typhoon’s substantial operational capability and resource investment in discovering and exploiting zero-day vulnerabilities, utilizing ephemeral, fast-shifting relay networks to mask strategic pre-positioning activities. The continued abuse of critical flaws in enterprise management platforms underscores the urgent need to minimize internet exposure of globally privileged systems and enhance visibility across network and memory layers.

References