Volt Typhoon’s Silent Train shows the management plane is now the target, not the route

Volt Typhoon spent three years using a disposable relay network to break into the systems that run other networks, according to Lumen’s Black Lotus Labs ^[1]. Lumen calls the network Silent Train. It says the operators used it to exploit at least four confirmed zero-days and one likely zero-day in SD-WAN orchestrators, remote monitoring tools and endpoint managers ^[1]. On the same day, Cisco Talos described KeyDrift, an implant that runs inside Cisco SD-WAN controllers and collects keying material ^[2]. Talos assesses with high confidence that the actor behind it, UAT-11473, shares much of its infrastructure with Silent Train ^[2]. The two reports describe one problem from two ends: how the operator arrives, and what it does once it holds the control plane.

What the data says

Lumen first saw consistent Silent Train activity in November 2023, weeks before the first disruption of the KV-botnet ^[1]. The Justice Department says that court-authorised operation removed malware from hundreds of end-of-life SOHO routers that PRC state-sponsored hackers used to hide their origin ^[13]. Black Lotus Labs says activity surged after the second disruption in January 2024, when the group moved to short-lived infrastructure ^[1][6]. Its targeting data runs to July 2026 ^[1].

Each session runs through a staging VPS, a second VPS, compromised SOHO and IoT devices outside the United States, and a compromised US device as the exit ^[1]. Lumen gives an average of four nodes before US address space, with as many as six hops between operator and victim ^[1]. Chains could be assembled in under two minutes ^[1]. Device types kept fixed roles: Intelbras modems appeared only as overseas relays, while Netgear Orbi units served as US hops that touched victims ^[1][5]. Lumen counts more than 27 device classes; The Hacker News reports at least 27 ^[1][6]. Some relay devices had no known vulnerability, which Lumen reads as a sign of further undisclosed exploits ^[1][4]. From early 2025 the operators also kept compromised enterprise platforms for one to three months and added Chisel and FRP reverse tunnels ^[1].

The figures on session length differ. Lumen’s text says sessions averaged about four hours, some only minutes, but its own figure caption says most lasted around eight to ten hours ^[1]. BleepingComputer reports that sessions typically last under eight hours ^[5]. Activity clustered on weekdays between 09:00 and 22:00 China Standard Time, with multi-week pauses over Chinese New Year ^[1].

The zero-days all sit in management planes. Versa Director CVE-2024-39717 was exploited from June 2024; Versa says an APT used it in at least one case and that the victims had left a management port exposed ^[11][12]. N-able fixed CVE-2025-8875 and CVE-2025-8876 in N-central in August 2025 ^[9]. Its release notice describes them as authenticated flaws and does not mention exploitation, while The Hacker News reports N-able saw exploitation in a limited number of on-premises environments ^[9][10]. Cisco’s CVE-2026-20127, rated 10.0, lets an unauthenticated attacker obtain administrative access to Catalyst SD-WAN Controller, Manager and Validator, and has no workaround ^[3]. Arista says VeloCloud Orchestrator CVE-2026-16812 was discovered externally and is actively exploited ^[8]. Lumen attributes both to Volt Typhoon and says Cisco SD-WAN exploitation began by late 2025 and continued after disclosure ^[1]. For Quest KACE, Lumen assesses a zero-day with moderate confidence and counts more than 30 victims ^[1].

KeyDrift shows what control-plane access buys. Talos describes PolyFlame, a memory-resident implant injected into the controller’s vdaemon process, and LittleFilch, which hooks SSL_read to extract session identifiers and assessed data-plane key material, encrypts the records and can send them over UDP ^[2]. Commands arrive inside SD-WAN control traffic, and no hardcoded C2 address was recovered ^[2][7]. Talos names space and satellite services, defence and aerospace technology, and policy research as targets ^[2]. It gives no victim count and calls the activity historical ^[2]. The Hacker News reports that Talos has tracked exploitation of the same flaw as UAT-8616 back to at least 2023, without stating how the two clusters relate ^[7]. Cisco updated its advisory on 28 October only to add the Talos link ^[3].

What it means

Silent Train is built to defeat the controls most organisations rely on. The exit node is domestic, so geofencing passes it. The node is used for hours and then abandoned, so reputation feeds lag. In April the UK NCSC and fifteen partner agencies, including Japan’s National Cybersecurity Office, Australia’s ACSC and New Zealand’s NCSC, warned that China-nexus actors share externally managed covert networks and that indicators disappear as quickly as they are found ^[15][16][17]. Lumen’s report is a detailed case study of that warning.

The target selection matters more than the relay. Lumen says the group chose platforms that hold trust over many downstream customers: MSP tooling, network management and SD-WAN orchestration ^[1]. Nextgov reports Lumen’s view that telecom providers were reached through enterprise IT management tools rather than directly ^[4]. One compromised orchestrator yields many networks. A controller that holds tunnel keys offers collection without touching an endpoint, and KeyDrift is built for exactly that ^[2].

The geography is also consistent. Lumen found Hawaii, California and Texas the most targeted states and ties them to Indo-Pacific military, telecom and logistics assets ^[1][4]. In 2023 Microsoft assessed with moderate confidence that Volt Typhoon was developing capabilities to disrupt communications between the United States and Asia, naming Guam ^[14]. The earliest VersaMem sample was uploaded from Singapore, which Black Lotus Labs suggested may indicate testing against non-US victims first ^[12].

What to do

• Inventory every internet-reachable management interface: SD-WAN orchestrators and controllers, RMM, UEM and network management consoles. Move them behind a VPN, jump host or dedicated management network ^[1][11].
• Patch management and control-plane products ahead of general estate. Confirm fixed releases for CVE-2026-20127, CVE-2026-16812, CVE-2025-8875, CVE-2025-8876 and CVE-2024-39717 against vendor advisories ^{[3][8][9][11]}.
• On Cisco Catalyst SD-WAN, restrict ports 22 and 830 to known controllers, review auth.log for vmanage-admin public-key logins from unknown addresses, and hunt for the runit and vdaemon artefacts Talos lists. Blocking ports does not remove an existing implant ^[2][3][7].
• Treat an upgrade as incomplete until compromise is ruled out. According to The Hacker News, Cisco’s remediation guide warns of exploits that may persist after an upgrade, and CISA’s directive required federal agencies to redeploy SD-WAN components from patched images ^[7].
• Rotate credentials and key material reachable from a suspected orchestrator, including those for managed edge devices, as Arista advises for VeloCloud ^[8].
• Baseline edge and VPN traffic, require MFA for remote access and use allow lists or machine certificates where possible. Do not treat a domestic source address as trusted ^[16].
• Centralise management-plane logs and extend retention. Hunt for administrative logins, API calls, file transfers and configuration changes outside normal workflows ^[1].

The cyber operations view

The KV-botnet takedown did not end Volt Typhoon’s relay capability. Lumen’s data shows it was rebuilt as something harder to see within weeks ^[1][13]. The lasting lesson is about targets. The group went after the consoles that administer fleets of routers, endpoints and branch tunnels, because one foothold there is worth hundreds elsewhere ^[1][2]. Asia-Pacific telcos, MSPs and defence suppliers run the same SD-WAN and RMM products, and three regional agencies have already signed the warning on covert networks ^[15]. Any organisation that manages networks on behalf of others should assume its management plane is a priority target and defend it accordingly.