Lumen Black Lotus Labs published detailed technical analysis on October 29 of a new Volt Typhoon technique they named Silent Train. The campaign builds a covert rotating relay network inside compromised routers, IoT devices, and enterprise network appliances across the United States and allied countries. Instead of using fixed command-and-control infrastructure, Volt Typhoon cycles through relay nodes on a rotating schedule, making origin attribution and IP blocklists ineffective as primary defenses.
How Silent Train works
The relay nodes are not Volt Typhoon's own infrastructure. They are devices the threat actor has compromised at organizations across multiple sectors. Traffic from a targeted network egresses through one of these nodes before reaching the actual C2, then returns through another. The rotation schedule appears algorithmically driven, with each node cycling in and out of active use over days or weeks. This makes signature-based egress monitoring significantly less effective as a standalone detection layer.
The four zero-days
CVE-2024-39717 affects Versa Director, the management plane for Versa Networks SD-WAN. The vulnerability is a server-side request forgery flaw that Volt Typhoon used to gain initial access to edge devices managed through Versa Director.
CVE-2025-8875 and CVE-2025-8876 affect N-able N-Central, a remote monitoring and management platform widely deployed by managed service providers. Both are remote code execution vulnerabilities. Compromise of a single N-Central instance can cascade across the MSP's full customer base.
CVE-2026-20127 affects Cisco Catalyst SD-WAN Manager. The vulnerability allows command injection from an adjacent network position. Cisco Catalyst SD-WAN is pervasive in US government and defense contractor networks, which aligns directly with Volt Typhoon's documented target profile.
CVE-2026-16812 affects VMware VeloCloud Orchestrator, an SD-WAN management platform used across enterprise and service provider edge deployments. The vulnerability allows authentication bypass.
Targets and corroborating research
The confirmed target sectors include US federal agencies, telecommunications providers, defense contractors, and critical infrastructure operators across multiple CISA-designated sectors. Cisco Talos published a parallel report the same day documenting overlapping activity they track as UAT-11473, code-named KeyDrift. The two reports give defenders partially complementary indicator sets from independent research teams.
What defenders should do
Patch all four CVEs immediately. If your organization uses Versa Director, N-able N-Central, Cisco Catalyst SD-WAN Manager, or VMware VeloCloud Orchestrator, treat the patch window with the same urgency as a CISA KEV deadline regardless of FCEB status.
Pull the Lumen Black Lotus Labs IOC list and run it against 90 days of egress logs. The relay architecture means your logs may show traffic to IP addresses that appear to be legitimate domestic or commercial hosts. Cross-reference against the IOC set before treating anomalous egress as benign.
Restrict management plane access. Versa Director, N-Central, and VeloCloud Orchestrator should not be reachable from the general internet. Require network-level authentication for management access, not only application-layer credentials.
Gigia Tsiklauri covers threat intelligence and security operations at Infosec.ge