Volt Typhoon exploited four zero-days through router relays

Volt Typhoon routes its attacks through a chain that begins on VPS infrastructure outside the United States, passes through compromised routers acting as intermediate relays, and ends at the target. Black Lotus Labs, Lumen’s threat research division, calls the framework Silent Train and has tracked it for three years. In that time it confirmed Volt Typhoon used the framework to exploit at least four zero-day vulnerabilities against edge and management infrastructure.

The relays are specific. Intelbras modems served as overseas hops; Netgear Orbi devices acted as hops inside the US. Operators reach these through exposed web interfaces on SOHO, IoT, and other relay devices, then deploy only enough tooling to enable chained SSH access through the node: temporary SSH services, keys, configuration files, and live-off-the-land utilities. When the session ends, typically in under eight hours, they remove the tooling, keys, and configuration files.

The zero-days Black Lotus Labs observed all hit management and edge platforms:

• CVE-2026-16812 in VeloCloud Orchestrator
• CVE-2026-20127 in Cisco Catalyst SD-WAN
• CVE-2025-8875 and CVE-2025-8876 in N-able N-central
• CVE-2024-39717 in Versa Director
• A suspected zero-day in Quest KACE

Each of these sits above the devices it manages. Compromising one gives broad administrative control: credential theft, remote access, and reach into downstream customers, without the noisy lateral movement that usually trips detection. For an MSP’s RMM platform or an SD-WAN orchestrator, that reach runs straight into the customer networks they manage.

Targets span telecommunications, government agencies, defense contractors, educational institutes, utilities and critical infrastructure, satellite service providers, IT firms, MSPs, transportation, aviation, and emergency services. The most targeted regions were California, Texas, and Hawaii, which Black Lotus Labs reads as a focus on Indo-Pacific matters. That fits the group’s record: CISA has warned that Volt Typhoon’s interest in US communications, energy, transportation, and water systems is about establishing access for potential disruption during a future crisis or conflict.

Black Lotus Labs ties the framework’s growth to law enforcement. After the FBI disrupted KV-Botnet, the relay network Volt Typhoon had used to mask attacks on US critical infrastructure, the group leaned harder on Silent Train. By early 2025 the framework had gone hybrid, pairing disposable relays torn down in hours with compromised enterprise systems kept for one to three months. The researchers believe Silent Train is reserved for high-value targets and careful, hands-on operations run on China Standard Time, and they read the use of zero-days against those targets as support for that.

The cleanup discipline is the part worth sitting with. The session typically ends in under eight hours, and the operators strip their tooling, keys, and configuration files from the disposable relay when it does. Black Lotus Labs’ recommendations follow directly: centralize logs and extend retention, since the traces on the relay are short-lived and centralized logs are what outlast them. Restrict internet access to administrative interfaces. Patch edge and management products quickly; those are the ones being burned. Monitor for unusual administrative activity rather than lateral movement, because the design deliberately skips the lateral movement most detections watch for. If you run an MSP or any platform with trusted connections into customer or partner networks, review those connections, because that reach is what a single compromise buys.

For anyone who hasn’t acted already, Black Lotus Labs also points to existing CISA and NCSC guidance on Volt Typhoon.