Volt Typhoon's Silent Train network tied to Cisco SD-WAN zero-day exploitation
ZERO-DAYBlack Lotus Labsredteam/daily · 2 sources
- Severity
- High
- Sources
- 2
What happened
Lumen Black Lotus Labs reports that Silent Train, a now-disrupted covert network first seen in late 2023, uses rotating chains of compromised SOHO, IoT and enterprise infrastructure and has supported four zero-day exploitation campaigns attributed to Volt Typhoon. Cisco Talos linked key-stealing malware used against Cisco SD-WAN to infrastructure overlapping with Silent Train. The excerpts give no CVE IDs, affected versions or indicators, so defenders should consult the full Cisco Talos and Lumen reports for those. Teams running SD-WAN should review the vendor guidance and watch for traffic from compromised edge devices.
For security analysts · Written by AI from 2 sources · Wrong?
What to do
- Check the vendor’s advisory and install the fix as soon as it is available.
General advice for this kind of story
Full story timeline · 2 updates
Who reported · 2 outlets
The Hacker NewsSecurityWeek
Who and what is in it
Threat actors
Companies