Volt Typhoon's Silent Train: How China's APT Is Using Zero-Days to Pre-Position Inside U.S. Critical Infrastructure
Executive Summary
Chinese state-sponsored threat actor Volt Typhoon has been operating a covert relay infrastructure called 'Silent Train' for at least three years, exploiting at least four zero-day vulnerabilities—including CVE-2026-16812 in VeloCloud Orchestrator, CVE-2026-20127 in Cisco Catalyst SD-WAN, CVE-2025-8875/8876 in N-able N-central, and CVE-2024-39717 in Versa Director—to target telecommunications firms, government agencies, defense contractors, utilities, and critical infrastructure providers primarily across California, Texas, and Hawaii. The framework chains compromised SOHO routers and IoT devices as ephemeral relays, with operators erasing all tooling within eight hours of session completion to evade forensic detection while maintaining persistent access to high-value enterprise systems for one to three months.
Silent Train represents a significant evolution beyond Volt Typhoon's disrupted KV-Botnet infrastructure, demonstrating the group's adaptive capacity and sustained intent to pre-position within U.S. critical infrastructure ahead of potential geopolitical conflict. The campaign's hybrid use of disposable relays and retained enterprise footholds signals a maturing operational playbook that poses escalating risk to any organization managing edge networking, SD-WAN, or centralized IT management platforms.
Why This Matters Now
With Silent Train actively targeting SD-WAN orchestrators, MSP management platforms, and edge infrastructure across U.S. critical sectors in 2025–2026, organizations face an urgent window to patch exposed management interfaces, enforce zero-trust segmentation, and implement east-west traffic controls before Volt Typhoon activates pre-positioned access during a future geopolitical crisis.
Attack Path Analysis
Volt Typhoon leveraged the Silent Train framework to exploit zero-day vulnerabilities in edge and management platforms (VeloCloud Orchestrator, Cisco Catalyst SD-WAN, N-able N-central, Versa Director, Quest KACE) via exposed web interfaces, routing attacks through rotating chains of compromised SOHO/IoT relays and VPS infrastructure to obscure origin. After gaining initial footholds, the group escalated privileges by stealing credentials from management platforms, moved laterally into downstream customer and partner networks, maintained covert C2 through chained SSH sessions over disposable relay nodes, exfiltrated targeted data during sub-8-hour operational windows, and pre-positioned persistent access in high-value critical infrastructure for potential future disruption aligned with Chinese state interests.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Volt Typhoon exploited zero-day vulnerabilities in internet-exposed management and edge platforms — CVE-2026-16812 (VeloCloud Orchestrator), CVE-2026-20127 (Cisco Catalyst SD-WAN), CVE-2025-8875/8876 (N-able N-central), CVE-2024-39717 (Versa Director), and a suspected zero-day in Quest KACE — accessing web interfaces on SOHO, IoT, and enterprise devices. Attacks were routed through overseas VPS nodes and compromised Intelbras modems and Netgear Orbi devices acting as rotating relay hops to obscure attacker origin.
Related CVEs
CVE-2024-39717
CVSS 7.2A file upload vulnerability in Versa Director allows authenticated attackers to upload malicious files, enabling remote code execution and persistent access to network management infrastructure. Exploited by Volt Typhoon as part of the Silent Train framework to compromise ISPs and MSPs.
Affected Products:
Versa Networks Versa Director – < 22.1.4, < 21.2.3
Exploit Status:
exploited in the wildReferences:
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Valid Accounts
Proxy: Multi-hop Proxy
Account Manipulation
Indicator Removal
Archive Collected Data
Remote Services: SSH
Active Scanning: Vulnerability Scanning
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
CISA Zero Trust Maturity Model 2.0 – Network Segmentation and Least-Privilege Access to Administrative Interfaces
Control ID: Network Pillar — Micro-Segmentation & Traffic Filtering
NIST SP 800-53 Rev. 5 – Malicious Code Protection, Software Integrity, Continuous Monitoring, and Incident Response
Control ID: SI-3, SI-7, CA-7, IR-4
NIS2 Directive (EU) 2022/2555 – Risk Management for Critical and Essential Entities and Significant Incident Notification
Control ID: Article 21 — Cybersecurity Risk Management Measures; Article 23 — Incident Reporting
DORA (EU Regulation 2022/2554) – ICT Third-Party and Operational Resilience
Control ID: Article 9 — ICT Security; Article 17 — ICT-Related Incident Management
PCI DSS v4.0 – Network Access Controls, Vulnerability Management, Authentication, and Log Monitoring
Control ID: Requirement 1.3, 6.3, 8.2, 10.7
NYDFS 23 NYCRR Part 500 – Privileged Access Management, Continuous Monitoring, and Cybersecurity Incident Response Planning
Control ID: 500.5 — Penetration Testing; 500.7 — Access Privileges; 500.14 — Monitoring; 500.16 — Incident Response
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Telecommunications
Volt Typhoon's Silent Train framework directly targeted telecom firms via zero-day exploits in SD-WAN and orchestration platforms, enabling persistent credential theft, lateral movement, and covert exfiltration of communications infrastructure data.
Government Administration
Government agencies are explicitly named targets of Volt Typhoon's APT espionage campaign, with Silent Train enabling stealthy pre-positioning across administrative systems for potential disruption during geopolitical conflict or crisis.
Defense/Space
Defense contractors face critical exposure as Volt Typhoon exploited N-able N-central and Versa Director zero-days, granting broad administrative control and downstream customer access aligned with Chinese state-sponsored intelligence collection objectives.
Utilities
CISA-warned critical infrastructure targeting confirms utilities face active Silent Train pre-positioning risk, with east-west lateral movement and encrypted exfiltration threatening operational technology environments supporting energy and water systems.
Sources
- Volt Typhoon hides zero-day attacks using 'Silent Train' frameworkhttps://www.bleepingcomputer.com/news/security/volt-typhoon-hides-zero-day-attacks-using-silent-train-framework/Verified
- Black Lotus Labs: Silent Train - Volt Typhoon Operational Frameworkhttps://www.lumen.com/blog/en-us/silent-train-volt-typhoon-operational-frameworkVerified
- CISA Known Exploited Vulnerabilities Catalog - CVE-2024-39717https://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- NVD - CVE-2024-39717 Detailhttps://nvd.nist.gov/vuln/detail/CVE-2024-39717Verified
- CISA Advisory: Volt Typhoon Targets U.S. Critical Infrastructurehttps://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144aVerified
- Versa Networks Security Bulletin - Versa Director Vulnerabilityhttps://versa-networks.com/blog/versa-security-bulletin-aug-26-2024/Verified
- FBI Disrupts Chinese Botnet by Wiping Malware from Infected Routers (KV-Botnet)https://www.bleepingcomputer.com/news/security/fbi-disrupts-chinese-botnet-by-wiping-malware-from-infected-routers/Verified
- CISA Shares Advice on Isolating Vital Systems During Cyberattackshttps://www.bleepingcomputer.com/news/security/cisa-shares-advice-on-isolating-vital-systems-during-cyberattacks/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant to this incident because Volt Typhoon's entire operational chain depended on unrestricted reachability to exposed management interfaces, unconstrained lateral movement across interconnected networks, and unmonitored outbound relay channels — all of which Zero Trust segmentation and identity-aware east-west enforcement would likely reduce. By enforcing granular workload isolation and controlled egress across cloud and hybrid environments, CNSF would likely have constrained the blast radius at multiple stages before pre-positioning could be achieved.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Zero Trust fabric policy would likely reduce the reachability of exposed management interfaces from arbitrary external relay infrastructure, constraining the inbound attack surface available to Volt Typhoon's rotating relay chain and limiting which source paths could initiate connections to orchestration platforms.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely constrain the scope of administrative access that compromised management plane credentials could exercise across downstream workloads, reducing how broadly harvested session tokens and credentials could be leveraged to traverse into connected customer and partner environments.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement would likely reduce the pathways available for lateral movement between downstream customer segments and across interconnected network zones, constraining how freely valid credentials could be used to traverse from one environment into adjacent high-value networks without policy-permitted justification.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility and control would likely surface anomalous outbound SSH relay sessions traversing cloud-hosted workloads toward external VPS infrastructure, constraining the unmonitored channel space that Volt Typhoon's chained tunnel architecture depended on for persistent and disposable C2 operation.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security policy enforcement would likely constrain the outbound paths available for exfiltration traffic, reducing the range of external relay destinations reachable from cloud-hosted workloads and limiting how freely encrypted data transfers could be routed through rotating VPS infrastructure outside policy-permitted destinations.
If Zero Trust segmentation, east-west enforcement, and controlled egress had constrained earlier stages, the persistent footholds required for pre-positioning across critical infrastructure sectors would likely be narrower in scope — reducing the number of independently accessible beachheads available for future disruption and limiting the attacker's ability to maintain simultaneous durable access across telecommunications, utility, and defense environments.
Impact at a Glance
Affected Business Functions
- Network Operations and Edge Infrastructure Management
- Managed Service Provider (MSP) Customer Tenant Administration
- Critical Infrastructure Supervisory Control and Operational Technology (OT) Systems
- Telecommunications Service Delivery and Satellite Communications
Estimated downtime: N/A
Estimated loss: N/A
The Silent Train framework enabled Volt Typhoon to achieve persistent, covert access across a broad range of high-value sectors including telecommunications, government agencies, defense contractors, utilities, satellite service providers, aviation, transportation, and emergency services. Data at risk includes network credentials and administrative secrets from centralized management platforms (Versa Director, Cisco SD-WAN, N-able N-central), configuration data enabling downstream customer compromise via MSP trust chains, sensitive government and defense contractor operational data, critical infrastructure operational telemetry, and personally identifiable information (PII) associated with government and utility customers. The geographic focus on California, Texas, and Hawaii suggests strategic pre-positioning relevant to Indo-Pacific military and civilian operations. The long-dwell-time nature of the campaign (enterprise node retention of 1-3 months) indicates significant exfiltration opportunity across all targeted verticals.
Recommended Actions
Key Takeaways & Next Steps
- • Apply Zero Trust Segmentation (microsegmentation and identity-based policy enforcement) to isolate management platforms such as SD-WAN controllers, RMM tools, and network orchestrators from general enterprise networks, ensuring that compromise of a single management plane cannot grant unconstrained lateral access to downstream customer or partner environments.
- • Deploy East-West Traffic Security controls to monitor and enforce policy on workload-to-workload and service-to-service traffic flows, detecting and containing the low-noise lateral movement enabled by valid administrative credentials harvested from compromised centralized management systems.
- • Enforce Egress Security and Policy via FQDN filtering and outbound traffic controls to restrict management platform communications to explicitly authorized destinations, blocking the exfiltration of credentials and operational data through covert relay channels and preventing callback to Silent Train VPS infrastructure.
- • Leverage Multicloud Visibility and Control capabilities to establish behavioral baselines for administrative activity across hybrid and multi-cloud environments, enabling detection of anomalous SSH chaining patterns, off-hours administrative sessions aligned with China Standard Time, and the temporary deployment and removal of SSH keys and services characteristic of Silent Train operations.
- • Implement Inline IPS (Suricata) and Cloud Native Security Fabric (CNSF) inline enforcement at ingress points for all internet-exposed management interfaces to detect and block known and emerging exploit traffic targeting edge and orchestration platforms, and restrict internet accessibility of administrative interfaces to reduce the zero-day attack surface exploited across VeloCloud, Cisco SD-WAN, N-able N-central, Versa Director, and Quest KACE.
