Threat feed

Volt Typhoon Silent Train

Volt Typhoon hides zero-day attacks on SD-WAN and RMM consoles behind throwaway SOHO relay chains

Posted · Updated · Spectrum Delta Research Team

Summary

Volt Typhoon chains compromised home and small-office devices into short-lived SSH relays, then wipes them, to launch zero-days against SD-WAN and RMM management consoles. Black Lotus Labs (Lumen, Oct 28) calls the framework Silent Train: at least four zero-days, including VeloCloud CVE-2026-16812 and Cisco SD-WAN CVE-2026-20127, sessions under 8 hours, hybrid since early 2025. Attribution is Black Lotus Labs' assessment; victims are not enumerated.

Breakdown

Adversary

Volt Typhoon

Procedures (3)

  1. Relay device hijacked, SSH chained

    Relay compromised via exposed web interface, minimal tooling deployed for chained SSH

    • T1190Exploit Public-Facing Application
    • T1021.004Remote Services: SSH

    Logs

    • Edge device management · Web-interface logins, SSH service starts, key/config changes
    • NetFlow / flow telemetry · Chained SSH to overseas VPS; device-to-device sessions

    Detectors

    No known detector

Click to expand remaining (2) procedures

  1. Relay wiped after session

    Sessions under 8 hours, tooling and keys removed after each operation

    • T1070.004Indicator Removal: File Deletion

    Logs

    • Edge device management · Web-interface logins, SSH service starts, key/config changes
    • NetFlow / flow telemetry · Chained SSH to overseas VPS; device-to-device sessions

    Detectors

    No known detector

  2. Zero-day on SD-WAN/RMM console

    Zero-day exploitation of edge and management platforms for admin control and downstream reach

    • T1190Exploit Public-Facing Application
    • T1078Valid Accounts

    Logs

    • SD-WAN/RMM console logs · Admin sessions on orchestrator/RMM/Director/KACE

    Detectors

    No known detector

Indicators of compromise

Hunt only

Exploited flaws: CVE-2026-16812 (VeloCloud Orchestrator), CVE-2026-20127 (Cisco Catalyst SD-WAN), CVE-2025-8875 and CVE-2025-8876 (N-able N-central), CVE-2024-39717 (Versa Director); suspected Quest KACE zero-day. Relay device classes: Intelbras modems (overseas hops), Netgear Orbi (U.S. hops); overseas VPS upstream. Assessed 2026-10-28.

Durable

Chained SSH egress from SOHO/IoT devices to overseas VPS; temporary SSH services, keys and configs created then deleted on edge devices; admin sessions on SD-WAN/RMM consoles from residential or overseas ASNs during China Standard Time hours; sessions under 8 hours followed by full cleanup

Sources

Grades are source reliability (A–F) and information credibility (1–6).

Questions, detections or sightings of Volt Typhoon Silent Train? Bring them to the community.

Discuss in the Tradecraft Slack