Silent Train: Lumen's Black Lotus Labs describes the rotating relay network Volt Typhoon used for one likely and four confirmed zero-day campaigns against management and control-plane platforms (Quest KACE, Versa Director, N-able N-central, Cisco Catalyst SD-WAN, Arista VeloCloud Orchestrator)

Lumen's Black Lotus Labs reports that Volt Typhoon used a covert framework it calls Silent Train, first seen in late 2023, for the phases that need protection: exploitation, credential access, data exfiltration and continued access to victims (Lumen Black Lotus Labs, 2026-10-28). A session starts from a virtual private server outside the US, passes through compromised non-US SOHO and IoT devices and leaves through a compromised US device before the victim; more than 27 device classes were enrolled, from TP-Link routers and Netgear Orbi devices to Fortinet appliances and CyberPanel servers, and the enterprise platforms stayed in chains for one to three months as final hops (Lumen Black Lotus Labs, 2026-10-28). The operators exploit exposed web interfaces on the relay devices and deploy only what chained SSH needs, namely temporary SSH services, keys, configuration files and living-off-the-land utilities, with reverse tunnels over open-source proxies in later variants; sessions averaged about four hours, and at the end the operators removed all artifacts and dismantled the chain (Lumen Black Lotus Labs, 2026-10-28).

Lumen says its monitoring helped identify one likely and four confirmed zero-day campaigns against endpoint and network management platforms and SD-WAN orchestrators: Quest KACE, where the activity looked like an undisclosed flaw, affected more than 30 victims and fell after Quest's October 2025 updates (a moderate-confidence assessment); Versa Director in 2024; the N-able N-central flaws CVE-2025-8875 and CVE-2025-8876; Cisco Catalyst SD-WAN through CVE-2026-20127, exploited by late 2025 and after Cisco's February 2026 disclosure; and Arista VeloCloud Orchestrator through the zero-day later designated CVE-2026-16812 (Lumen Black Lotus Labs, 2026-10-28). Post-incident analysis found in-memory webshells, credential harvesting and abuse of native platform features such as endpoint control and remote file transfers, and in several cases erased or altered logs (Lumen Black Lotus Labs, 2026-10-28). The victims it names are US government, telecommunications, defence-industrial, managed-service and critical-infrastructure organisations, concentrated in Hawaii, California and Texas, and it names no European or Swiss victim (Lumen Black Lotus Labs, 2026-10-28). The Hacker News carries the same findings from a report Lumen shared with it (The Hacker News, 2026-10-28).