HighZero-Day
Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns
The Hacker News·Source published ·1 min read·Video available
Advisory videoOpen on YouTube ↗
What happened?
The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been put to use for zero-day exploitation and strategic access.
Key details
- Silent Train employs anti-forensic techniques and post-operation cleanup to avoid detection.
- Hundreds of victims span telecommunications, government, defense, critical infrastructure, and other sectors.
- Four confirmed zero-day campaigns were conducted through Silent Train between 2024 and 2026.
- Silent Train uses multi-hop chains with VPS, non-U.S. devices, and U.S. exit nodes to obscure attack origins.
- Operations focus on Hawaii, California, and Texas due to military and critical infrastructure presence.
Affected
- Versa Director (CVE-2024-39717) exploited as zero-day.
- N-able N-central (CVE-2025-8875 and CVE-2025-8876) insecure deserialization and command injection.
- Cisco Catalyst SD-WAN Controller (CVE-2026-20127) authentication bypass.
- Arista VeloCloud Orchestrator (CVE-2026-16812) OS command injection.
- Quest KACE suspected zero-day exploited before October 2025 patch.
- At least 27 device classes exploited including TP-Link, Netgear, Fortinet, Cisco, and others.
Fixes and mitigations
- Quest KACE patched in October 2025.
What to look for
- Short-lived SSH sessions averaging four hours with temporary keys and configs.
- Use of open-source proxies Chisel and FRP for reverse-tunnel variants.
- Device-type compartmentalization: Intelbras modems as relays, Netgear Orbi and FortiGate as U.S. exit nodes.
- Ephemeral infrastructure with one-time-use chains of compromised devices.
Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.