HighZero-Day
Volt Typhoon hides zero-day attacks using 'Silent Train' framework
BleepingComputer·Source published ·1 min read
What happened?
Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems. [...]
Key details
- Volt Typhoon uses Silent Train framework of compromised devices to hide zero-day attacks
- Silent Train relays route attacks through overseas and US compromised devices
- Zero-day exploits target VeloCloudOrchestrator, Cisco Catalyst SD-WAN, N-able N-central, Versa Director
- After use, threat actors remove all tooling and keys from compromised relays within 8 hours
- Framework became hybrid in early 2025, using disposable relays alongside retained enterprise systems
Affected
- Intelbras modems used as overseas relays in Silent Train
- Netgear Orbi devices used as hops in the U.S. for Silent Train
- Products with known zero-day exploits: VeloCloudOrchestrator, Cisco Catalyst SD-WAN, N-able N-central, Versa Director, Quest KACE
Summarised by SecOraLens from BleepingComputer. Always read the original source before acting. How SecOraLens verifies advisories.