Volt Typhoon used covert Silent Train relay network to exploit zero-days in management platforms, Lumen reports
- Severity
- High
- Exploited
- Yes
- Sources
- 1
What happened
Lumen links Silent Train to exploitation of N-central (CVE-2025-8875, CVE-2025-8876), Cisco SD-WAN (CVE-2026-20127) and VeloCloud (CVE-2026-16812), plus a Versa Director campaign using an in-memory JAR webshell. A Quest KACE campaign affected more than 30 victims, but the flaw was not identified, and the zero-day link is assessed with moderate confidence. Chains used up to six hops, were built in under two minutes, and relied on temporary SSH services, keys and configuration files, with Chisel and FRP reverse tunnels also observed. Enterprise systems later hosted final connections lasting one to three months. Defenders should restrict internet-facing management interfaces, prioritise vendor patches, review downstream trust relationships, export logs externally with longer retention, and investigate unusual administrative activity, API requests, remote transfers and configuration changes.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- CVE-2025-8876 is being exploited: treat it as urgent.
- CISA’s required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Check whether you use N-able N-Central: add it to your watchlist to hear when it is affected. Open your watchlist
Based on advisory data