Volt Typhoon's Silent Train: How a Covert Relay Network Powered Four Zero-Day Campaigns Against U.S. Critical Infrastructure
Executive Summary
Beginning in late 2023 and accelerating through 2026, the China-state-sponsored threat group Volt Typhoon operated a covert relay network called Silent Train to execute four confirmed zero-day exploitation campaigns against critical U.S. infrastructure. The group systematically targeted endpoint management platforms, SD-WAN orchestrators, and network control-plane technologies—including CVE-2026-20127 in Cisco Catalyst SD-WAN Controller and CVE-2026-16812 in Arista VeloCloud Orchestrator—routing malicious traffic through rotating chains of compromised SOHO, IoT, and enterprise devices across 27 device classes. Victims spanned telecommunications, defense contractors, satellite services, energy, transportation, and emergency services, with operations concentrated in Hawaii, California, and Texas.
Silent Train represents a structural evolution in nation-state tradecraft: ephemeral multi-hop relay infrastructure that self-destructs after each session, making attribution and disruption exceptionally difficult. As geopolitical tensions in the Indo-Pacific intensify, this campaign signals that critical infrastructure operators must treat control-plane technologies and management platforms as primary attack surfaces requiring zero trust segmentation and continuous east-west traffic inspection.
Why This Matters Now
Volt Typhoon's Silent Train campaign is active and evolving in 2026, having already exploited four zero-days across widely deployed enterprise platforms. With U.S. federal agencies escalating Indo-Pacific readiness posture and adversaries pre-positioning inside defense, energy, and communications networks, organizations that rely on flat network architectures or unmonitored control-plane traffic face immediate, material risk of undetected long-term compromise.
Attack Path Analysis
Volt Typhoon exploited four zero-day vulnerabilities across endpoint management, SD-WAN, and network orchestration platforms via the Silent Train covert relay network, gaining initial footholds in critical infrastructure organizations. From there, the group harvested credentials, escalated privileges through compromised control-plane systems, moved laterally across enterprise environments using living-off-the-land techniques, maintained command and control through ephemeral multi-hop SSH chains routed through compromised SOHO and IoT devices, exfiltrated sensitive data over encrypted channels, and ultimately achieved persistent strategic access to defense, telecommunications, and critical infrastructure networks supporting U.S. national security interests.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Volt Typhoon exploited four confirmed zero-day vulnerabilities — CVE-2024-39717 (Versa Director file upload), CVE-2025-8875 and CVE-2025-8876 (N-able N-central insecure deserialization and command injection), CVE-2026-20127 (Cisco Catalyst SD-WAN Controller authentication bypass), and CVE-2026-16812 (Arista VeloCloud Orchestrator OS command injection) — targeting internet-exposed web interfaces of endpoint management platforms, SD-WAN orchestrators, and network management systems. A suspected zero-day in Quest KACE was also exploited. These platforms were selected because compromise of a single management system yields scalable downstream access. Traffic was routed through the Silent Train multi-hop relay chain of compromised SOHO, IoT, and enterprise devices to obscure origin. CNSF Inline IPS (Suricata) with current exploit signatures and Cloud Firewall (ACF) blocking exposure of management plane interfaces to untrusted networks would have significantly reduced the attack surface at this stage.
Related CVEs
CVE-2024-39717
CVSS 7.2A file upload vulnerability in Versa Director allows an authenticated remote attacker to upload and execute arbitrary files, enabling deployment of web shells such as VersaMem for credential harvesting and downstream customer access.
Affected Products:
Versa Networks Versa Director – < 22.1.4, < 21.2.3, < 22.1.2
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Valid Accounts
Server Software Component: Web Shell
Proxy: Multi-hop Proxy
Brute Force / Credential Access
Indicator Removal on Host
Exfiltration Over C2 Channel
Protocol Tunneling
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
CISA Zero Trust Maturity Model 2.0 – Network Segmentation and Device Integrity Enforcement
Control ID: Network Pillar – Macro/Micro Segmentation; Device Pillar – Device Visibility and Compliance
NIS2 Directive (EU) 2022/2555 – Supply Chain Security, Vulnerability Management, and Incident Notification
Control ID: Article 21 – Cybersecurity Risk Management Measures; Article 23 – Incident Reporting
NYDFS 23 NYCRR 500 – Privileged Access Control, Continuous Monitoring, and Incident Response Planning
Control ID: Section 500.7 – Access Privileges; Section 500.14 – Monitoring; Section 500.16 – Incident Response
DORA (EU) 2022/2554 – ICT Resilience, Threat Detection, and Major Incident Reporting
Control ID: Article 9 – ICT Security; Article 10 – Detection; Article 19 – Incident Reporting
PCI DSS 4.0 – Vulnerability Remediation, Log Integrity, and Incident Response
Control ID: Requirement 6.3 – Security Vulnerabilities; Requirement 10.7 – Audit Log Monitoring; Requirement 12.10 – Incident Response
ISO/IEC 27001:2022 – Technical Vulnerability Management, Network Controls, and Third-Party Security
Control ID: Annex A 8.8 – Management of Technical Vulnerabilities; Annex A 8.20 – Network Security; Annex A 5.23 – Information Security for Use of Cloud Services
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Telecommunications
Volt Typhoon's Silent Train APT directly targeted telecom providers via zero-day exploits and lateral movement, enabling exfiltration of sensitive transit data and persistent control-plane access across national communications infrastructure.
Defense/Space
Silent Train's deliberate focus on Hawaii, California, and Texas military installations and defense contractors exposes classified networks to credential harvesting, privilege escalation, and long-duration cyber espionage via compromised SD-WAN and endpoint management platforms.
Government Administration
Nation-state APT exploitation of authentication bypass and command injection zero-days in enterprise orchestration platforms threatens government network integrity, violating NIST 800-53 and ZTMM controls against lateral movement and unencrypted data exfiltration.
Transportation
Critical transportation infrastructure including maritime, rail, and aviation networks were confirmed Silent Train victims, with east-west lateral movement and egress exfiltration capabilities targeting mission-critical operational technology and logistics control systems.
Sources
- Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaignshttps://thehackernews.com/2026/10/volt-typhoon-used-covert-silent-train.htmlVerified
- NVD Detail: CVE-2024-39717 - Versa Director File Upload Vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2024-39717Verified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- Lumen Black Lotus Labs: Silent Train - Volt Typhoon Operational Frameworkhttps://www.lumen.com/blog/en-us/silent-train-volt-typhoon-operational-frameworkVerified
- Chinese Volt Typhoon Exploits Versa Director Zero-Day CVE-2024-39717https://thehackernews.com/2024/08/chinese-volt-typhoon-exploits-versa.htmlVerified
- Microsoft Warns of Chinese Botnet Targeting SOHO and IoT Deviceshttps://thehackernews.com/2024/11/microsoft-warns-of-chinese-botnet.htmlVerified
- US Feds Shut Down China-Linked KV-Botnethttps://thehackernews.com/2024/02/us-feds-shut-down-china-linked-kv.htmlVerified
- CISA Advisory: Volt Typhoon Targeting US Critical Infrastructurehttps://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038aVerified
- Chinese Hackers Operate Undetected in US Critical Infrastructure for Yearshttps://thehackernews.com/2024/02/chinese-hackers-operate-undetected-in.htmlVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Volt Typhoon's Silent Train campaign exploited internet-exposed management plane interfaces and leveraged control-plane credential access to achieve scalable reach across critical infrastructure — precisely the attack surface that Aviatrix Zero Trust CNSF is designed to constrain through segmentation, identity-scoped access, and controlled egress enforcement. Applying distributed inline enforcement across cloud-native and hybrid environments would likely have reduced the attacker's reachability at multiple stages, limiting the ability to convert initial footholds into strategic, long-duration access.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Distributed inline enforcement at the network perimeter would likely have reduced the reachability of exposed management plane interfaces, constraining the attacker's ability to deliver exploit payloads to vulnerable endpoints from untrusted source networks routed through covert relay infrastructure.
Control: Zero Trust Segmentation
Mitigation: Identity-aware segmentation policies would likely have constrained the blast radius of harvested management platform credentials, reducing the scope of lateral trust that a single compromised system could exercise across connected downstream environments.
Control: East-West Traffic Security
Mitigation: East-west enforcement at the workload and segment boundary level would likely have detected and constrained unauthorized internal flows between management platforms and downstream customer environments, reducing the attacker's ability to freely traverse connected network segments using legitimate-looking management traffic.
Control: Multicloud Visibility & Control
Mitigation: Centralized traffic observability across cloud-native and hybrid environments would likely have surfaced anomalous multi-hop SSH relay patterns and short-duration encrypted sessions originating from geographically diverse and unexpected source addresses, reducing the attacker's ability to sustain undetected C2 operations over time.
Control: Egress Security & Policy Enforcement
Mitigation: Controlled egress enforcement with FQDN filtering and outbound policy controls would likely have constrained unauthorized data transfers routed through covert relay infrastructure, reducing the attacker's ability to complete exfiltration over encrypted channels that fall outside sanctioned outbound communication paths.
Where earlier CNSF controls would likely have constrained initial reach, credential blast radius, and lateral movement scope, residual risk at this stage centers on attacker pre-positioning already established within management plane technologies — meaning the strategic access achieved across telecommunications, defense, and critical infrastructure networks may remain partially intact in environments where segmentation was not enforced prior to compromise.
Impact at a Glance
Affected Business Functions
- Critical Infrastructure Network Operations (Telecommunications, Energy, Water, Transportation)
- Defense Contractor and Satellite Communication Systems
- Enterprise Network Management and SD-WAN Control Plane Services
- Government and Emergency Services Continuity Operations
Estimated downtime: N/A
Estimated loss: N/A
The Silent Train covert access network facilitated long-term, stealthy espionage operations across hundreds of victim organizations. Data categories at risk include: sensitive government and defense communications, operational technology (OT) telemetry from energy and water utilities, network topology and credential data from telecommunications providers, satellite communication intercepts, supply chain and logistics data from defense contractors, and personally identifiable information (PII) of personnel at targeted universities and IT firms. Given the targeting of endpoint management platforms and SD-WAN orchestrators, downstream customer environments were exposed at scale, amplifying the scope of credential and configuration data access. The estimated financial loss is not publicly quantified; however, the strategic intelligence value of the exfiltrated data pertaining to US military installations, critical infrastructure, and Indo-Pacific operational readiness represents extraordinary national security risk that far exceeds typical financial metrics.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Zero Trust Segmentation with identity-based microsegmentation across all management plane systems — including SD-WAN orchestrators, endpoint management platforms, and network management systems — to enforce least-privilege access and prevent lateral movement from any single compromised control-plane node, aligned with ZTMM.Network and NIST.800-53.AC-6.
- • Implement Multicloud Visibility and Control with centralized traffic observability and behavioral baselining to detect anomalous multi-hop SSH relay chains, short-duration encrypted sessions from diverse geographies, and use of open-source proxy tools such as Chisel and FRP, aligned with ZTMM.CrossCutting.Visibility and NIST.800-53.AU-6.
- • Enforce Egress Security and Policy Enforcement with FQDN-based filtering and outbound traffic controls to block unauthorized data exfiltration destinations and prevent covert C2 communications over reverse tunnels and proxy relay infrastructure, aligned with ZTMM.Data and NIST.800-53.SC-18.
- • Deploy Inline IPS (Suricata) with current exploit signatures for all internet-exposed management interfaces to detect and block zero-day exploitation patterns associated with web shell delivery, deserialization attacks, and authentication bypass attempts against control-plane technologies, aligned with NIST.800-53.SI-4 and NIST.CSF.DE.CM-4.
- • Activate the Cloud Native Security Fabric (CNSF) as a distributed inline enforcement and real-time inspection layer across hybrid and multicloud environments to provide continuous posture-aware control that can detect operationally disciplined threat actors conducting short-lived, anti-forensic access operations targeting centralized management and orchestration infrastructure, aligned with ZTMM.CrossCutting.Automation and NIST.CSF.ID.RA-3.
