Volt Typhoon Hid Four Zero-Day Campaigns Behind a ‘Silent Train’ of Hijacked Routers, Lumen Says

Lumen Technologies says a relay system it tracked for three years gave the China-linked group known as Volt Typhoon a disposable route into strategically important networks. Its Black Lotus Labs unit linked the system, which it calls Silent Train, to four confirmed zero-day campaigns and one likely fifth, and said its monitoring produced hundreds of victim notifications across government, telecommunications, defense, satellite, university and critical-infrastructure organizations.

The network was built from compromised home routers, internet-connected devices and enterprise systems rather than permanent attacker-owned servers, according to Lumen. Black Lotus Labs said operators could assemble a multi-hop chain in less than two minutes, use it for a session and then erase the route—an operating pattern designed to make each intrusion harder to trace back to its source.

The four confirmed zero-day targets were Versa Director, N-able N-central, Cisco Catalyst SD-WAN and VeloCloud Orchestrator, according to Help Net Security’s independent account of the research. The publication also reported a possible Quest KACE zero-day. These are management platforms: control of one can give an intruder broad administrative reach into the systems it manages.

Cisco Talos separately said a cluster it tracks as UAT-11473 exploited CVE-2026-20127 to bypass authentication on Cisco SD-WAN Catalyst Controllers and install a custom framework called KeyDrift. Talos assessed with high confidence that the cluster’s infrastructure overlapped substantially with Silent Train, while stopping short of saying UAT-11473 and Volt Typhoon were the same actor.

KeyDrift injected into control-plane processes, persisted on controllers and could collect session metadata and what Talos assessed to be data-plane key material. Cisco said the activity targeted space and satellite services, defense and aerospace technology, and policy research. The company released patches and urged defenders to look for post-compromise activity rather than treating patching alone as proof that a network was clean.

Lumen said the most frequently observed U.S. victim locations were Hawaii, California and Texas, and assessed the pattern as consistent with maintaining access that could be useful during an Indo-Pacific crisis. That remains a vendor assessment: the public report does not name the victim organizations or disclose the underlying telemetry, limiting independent scrutiny of the attribution and scale.