Threat intel

On October 28, Lumen's Black Lotus Labs published three years of tracking on Silent Train, a relay network that China's Volt Typhoon group builds out of hacked routers, IoT devices and enterprise appliances, then tears down after each session. Lumen ties it to four confirmed zero-day campaigns and one likely one, all aimed at the systems that manage other systems: SD-WAN (software-defined wide area network) orchestrators, remote monitoring and management (RMM) platforms and endpoint management servers. Black Lotus Labs says it has notified hundreds of victims.

If you run Cisco Catalyst SD-WAN, an on-premises Arista VeloCloud Orchestrator, Versa Director, N-able N-central or Quest KACE, this applies to you directly. The same day, Cisco Talos reported that a cluster it calls UAT-11473, whose infrastructure overlaps heavily with Silent Train, used a Cisco SD-WAN flaw to plant a new implant called KeyDrift. Telecoms, managed service providers, defence suppliers and critical infrastructure operators were the main targets.

How the relay network works

Volt Typhoon used to rely on the KV botnet, a fixed set of compromised end-of-life routers that was taken down in December 2023. Lumen first saw consistent Silent Train activity in November 2023, just before that takedown, and watched it grow afterwards. The design trades persistence for disposability. Instead of keeping a standing botnet, operators compromise devices on demand, chain them together for one session, and remove their tools when they finish.

A session starts on a virtual private server (VPS) outside the United States. Traffic then passes through compromised overseas small office and home office (SOHO) and IoT devices, and finally through one or two compromised devices inside the US before it touches the victim, with up to six hops in total. Device types had fixed roles: Intelbras modems only ever served as overseas relays, while Netgear Orbi routers were the US hops that talked to victims. Because the last hop is a residential or business address in the US, geo-blocking and IP reputation lists see nothing unusual.

Lumen counted more than 27 device classes. Early chains used TP-Link, Netgear, Intelbras, Zyxel, Ruckus and Cambium gear, broken into through exposed web interfaces, and early devices were used for a single session and then restored to their original state. Later final hops were enterprise systems: Fortinet FortiGate and Cisco appliances, PRTG servers, Mirth Connect and CyberPanel. Some relay device types had no known vulnerability at all, which suggests the operators held further unpublished exploits. Early chains linked hops with SSH; later variants used the open-source reverse-tunnel tools Chisel and FRP.

Silent Train carried exploitation, credential theft and data theft. Reconnaissance ran over other infrastructure, so blocking scanners will not catch it. Activity clustered Monday to Friday between 9 a.m. and 10 p.m. China Standard Time, which Lumen reads as human operators working shifts.

What attackers went after

Each session typically hit one to five victims, often a single organization. The confirmed zero-day targets were all control-plane products, the consoles that push configuration, scripts and keys to everything beneath them:

• Versa Director, through CVE-2024-39717 (CVSS 7.2), a file upload flaw in the favicon feature that Black Lotus Labs documented in mid-2024 alongside the VersaMem in-memory webshell.
• N-able N-central, through the chained CVE-2025-8875 and CVE-2025-8876, which both require an authenticated session.
• Cisco Catalyst SD-WAN, through CVE-2026-20127 (CVSS 10.0), a broken peering authentication check that gives an unauthenticated attacker admin rights. Cisco disclosed and patched it on February 25, 2026, by which point it was already being exploited.
• Arista VeloCloud Orchestrator, through CVE-2026-16812 (CVSS 10.0), an unauthenticated operating system command injection in on-premises deployments, patched in late July 2026.

Lumen also links, with moderate confidence, a campaign against Quest KACE endpoint management that hit more than 30 victims and faded after Quest's October 2025 updates. Logs were too thin to name the bug. Beyond these, Lumen saw targeting of Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto Networks, ServiceNow and ArcGIS products, without always knowing whether the flaws used were public.

After getting in, the operators ran webshells in memory, harvested credentials and used the products' own features, such as endpoint control and remote file transfer, to move on. In several cases they erased or altered logs. Talos adds that KeyDrift, on compromised Cisco SD-WAN controllers, kept persistent access and exfiltrated data-plane keying material, the keys that protect traffic between sites.

What to do

1. Patch the five products first. Cisco Catalyst SD-WAN Controller and Manager: fixed releases include 20.9.8.2, 20.12.6.1 and 20.18.2.1, but published tables differ for the 20.12 to 20.15 trains, so confirm your build in Cisco advisory cisco-sa-sdwan-rpa-EHchtZk. Releases older than 20.9 must migrate. VeloCloud Orchestrator on premises: 5.2.3.14, 6.1.3.4, 6.4.2.4 or 7.0.0.1 (hosted orchestrators were patched by Arista). N-central: 2025.3.1 or 2024.6 HF2. Versa Director: 22.1.4 or later. Quest KACE: Quest's October 2025 updates or later.
2. Take management interfaces off the internet today if you cannot patch. Arista says the VeloCloud exposure cannot be switched off in the orchestrator itself, so a firewall rule or access list limiting the web interface to an admin network or VPN is the only interim control. Apply the same rule to SD-WAN managers, RMM consoles and KACE appliances.
3. Check Cisco SD-WAN for past compromise. Search /var/log/auth.log on controllers and managers for Accepted publickey for vmanage-admin and compare each source address with the System IPs listed in SD-WAN Manager. Anything else is a strong sign of exploitation.
4. Check VeloCloud. Look in web access and application logs for connections from 8.19.75.217, 206.72.242.124 and 206.72.242.162, which Arista published as a partial list. Also look for new administrator accounts, role changes, unexpected configuration pushes to edges and child processes spawned by the orchestrator service.
5. Hunt on the RMM and endpoint tools. In N-central and KACE, review admin logins, scripts and file transfers pushed to managed devices outside change windows. Anything you cannot tie to a ticket deserves a closer look at the target endpoint.
6. Clean up after a hit. Preserve logs and file timestamps before you rebuild. Then rotate every credential and key the console held: admin accounts, API tokens, stored device credentials, and on Cisco SD-WAN the certificates and keys that KeyDrift was built to steal.

Your own edge devices matter as well. A FortiGate, PRTG server or SOHO router at a branch can be someone else's final hop, so check those for unknown SSH listeners, unexpected keys in authorized_keys, and Chisel or FRP binaries, and keep their firmware current.

Logging the consoles that run everything else

In several of these intrusions the evidence was gone before anyone looked, and in the KACE case the logs were too thin to name the vulnerability. Management platforms tend to keep short local logs and ship nothing to a central store. Forward their authentication, audit and web logs to your SIEM (security information and event management system) with at least a year of retention, and alert on admin logins at odd hours or from addresses outside your management network. Treat any system that can push code or configuration to hundreds of hosts with the same care as a domain controller.

Our network penetration testing checks how exposed your SD-WAN and management interfaces are, and our security operations team can hunt for the signs above across your logs. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

---

Sources: Lumen Black Lotus Labs, Silent Train, Help Net Security, SecurityWeek, Nextgov, Qualys, CVE-2026-20127, Kudelski Security, CVE-2026-20127, Hive Pro, CVE-2026-16812, Resecurity, CVE-2026-16812, Help Net Security, N-central flaws, Dark Reading, Versa Director.