Volt Typhoon used covert Silent Train relay network to exploit zero-days in management platforms, Lumen reports
- Severity
- High
- Exploited
- Yes
- Sources
- 1
What happened
Lumen's Black Lotus Labs reports that Volt Typhoon used an operational framework called Silent Train, first seen in November 2023, to chain compromised routers, devices and enterprise servers as covert relays. The framework supported four confirmed and one likely zero-day campaign against management platforms including N-central, Versa Director, Cisco Catalyst SD-WAN, VeloCloud Orchestrator and Quest KACE. Victims included telecommunications, satellite communications, defence-linked universities and essential service operators, with Hawaii, California and Texas repeatedly targeted. Lumen assesses the activity as positioning for possible Indo-Pacific crises rather than evidence of disruption.
For IT people · Written by AI from 1 source · Wrong?
What to do
- CVE-2025-8876 is being exploited: treat it as urgent.
- CISA’s required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Check whether you use N-able N-Central: add it to your watchlist to hear when it is affected. Open your watchlist
Based on advisory data