Lumen links Volt Typhoon's Silent Train relay network to four confirmed zero-day campaigns

TLDR

• Talos says UAT-11473 exploited CVE-2026-20127 to deploy KeyDrift malware; its infrastructure overlaps considerably with Silent Train.⁵
• SecurityWeek says Talos does not equate UAT-11473 with Volt Typhoon; the Volt Typhoon attribution still rests on Lumen.¹⁶
• Talos says KeyDrift targets keying material on SD-WAN controllers; Cisco says upgrade and restrict ports 22 and 830.⁵⁸

Lumen Technologies' Black Lotus Labs reports that Volt Typhoon, a state-sponsored threat actor from China, used a covert network it calls Silent Train to conceal its activity while exploiting previously unknown vulnerabilities in centralised management platforms.¹ Lumen says it first saw consistent Silent Train activity in November 2023, has tracked it for the past three years, and notified hundreds of victims in that time, including telecommunications providers, government bodies, defence contractors, satellite communications services, universities, IT firms and critical infrastructure operators.¹ That monitoring supported investigations that uncovered one likely and four confirmed zero-day campaigns, according to Lumen.¹

The four confirmed campaigns hit Versa Director, N-able N-central, Cisco Catalyst SD-WAN and VeloCloud Orchestrator.¹⁴ Lumen assigns CVE-2025-8875 and CVE-2025-8876 to N-central, CVE-2026-20127 to Cisco and CVE-2026-16812 to VeloCloud Orchestrator.¹ The Hacker News adds CVE-2024-39717 for Versa Director, which Lumen publicly documented in mid-2024, and names Arista as the vendor of VeloCloud Orchestrator.¹³ Lumen says the Cisco flaw carries a CVSS score of 10.0, that Volt Typhoon was exploiting it by late 2025, and that exploitation continued well after Cisco disclosed it in February 2026.¹ The likely zero-day is in Quest KACE: Lumen says that campaign affected more than 30 victims and declined after Quest's October 2025 security updates, and that limited forensic evidence supports only a moderate-confidence assessment.¹ BleepingComputer lists all five products and labels Quest KACE a suspected zero-day.²

Silent Train sessions begin on virtual private servers outside the US, pass through compromised non-US devices, and exit through a compromised US device before reaching the victim, Lumen says.¹ Lumen reports more than 27 device classes exploited, from TP-Link and Netgear Orbi routers to Fortinet appliances and CyberPanel servers, and says operators could assemble a chain in under two minutes and removed all artefacts after each session.¹ By early 2025 the framework had become a hybrid that kept enterprise devices for one to three months, Lumen says.¹ The sources differ on session length: Lumen's text says sessions averaged about four hours, but a caption on its duration chart says most lasted around 8 to 10 hours, while BleepingComputer reports they typically end in under 8 hours.¹²

Lumen attributes Silent Train to Volt Typhoon throughout and points to sessions concentrated Monday to Friday between 09:00 and 22:00 China Standard Time as evidence of human operators.¹ The post gives a confidence level only for the Quest KACE zero-day and states none for the Volt Typhoon attribution itself.¹ Hawaii, California and Texas were the most targeted regions, and Lumen says the victimology points to efforts to keep access to defence, logistics and communications ecosystems, especially during heightened tensions or crises in the Indo-Pacific.¹ Lumen's Michael Horka told CyberScoop the observations are not a complete census of Volt Typhoon activity and that the framework is hard to disrupt because there is no single network to take down.⁴ Lumen advises tighter controls on management and control plane systems and less internet exposure of administrative services, and BleepingComputer adds that the researchers also recommend rapid patching and centralised logs with longer retention.¹²

Update, 30 October 2026: Cisco Talos has published its own report on a cluster it calls UAT-11473, which exploited the same Cisco SD-WAN flaw (CVE-2026-20127) to deploy a custom malware framework and whose infrastructure overlaps with Silent Train.⁵⁶ Talos, in a post dated 28 October, says UAT-11473 is a highly sophisticated advanced persistent threat actor that exploited the authentication bypass in Cisco SD-WAN Catalyst Controller instances and then installed a framework it tracks as KeyDrift.⁵ Talos says observed targeting spans space and satellite services, defence and aerospace technology, and policy research, and assesses with high confidence that UAT-11473's operating infrastructure overlaps considerably with Silent Train.⁵ SecurityWeek notes that Talos calls the activity historical but has not said when the attacks occurred.⁶

Talos says KeyDrift is designed for long-term persistent access and automated exfiltration of sensitive keying material, and that it runs inside SD-WAN control-plane processes where it can intercept decrypted control traffic.⁵ Its main module, PolyFlame, is a memory-resident backdoor injected into legitimate vdaemon processes that can also relay commands to other hosts as an intermediate command-and-control node.⁵⁶ A second module, LittleFilch, hooks SSL_read to extract, for predefined edge nodes, a 32-byte field that Talos assesses to be AES-256 IPsec data-plane key material, which it encrypts with RSA before sending it on.⁵⁷ Talos says variations in the modules and their deployment suggest the framework is under active development.⁵

On attribution, SecurityWeek says Talos does not say UAT-11473 and Volt Typhoon are the same group, and BleepingComputer reports that Talos made no definitive links.⁶⁷ Both outlets credit the Volt Typhoon link to Lumen's research rather than to Talos, and SecurityWeek adds that Lumen's report does not mention KeyDrift or UAT-11473.¹⁶⁷ The new reports therefore add infrastructure overlap but no independent attribution of Silent Train to Volt Typhoon.⁶⁷ BleepingComputer also reports that a cluster tracked as UAT-8616 has exploited CVE-2026-20127 as a zero-day since at least 2023, whereas Lumen says Volt Typhoon was exploiting it by late 2025.¹⁷ SecurityWeek, citing Lumen researcher Mike Horka's comments to journalist Kim Zetter, reports that the hackers also exfiltrated documents on military operations and network structures and that he believes the activity combines pre-positioning and espionage.⁶

Cisco's advisory for the flaw, first published on 25 February 2026 and last updated on 28 October 2026, rates it CVSS 10.0 and says it affects the Catalyst SD-WAN Controller, Manager and Validator regardless of configuration.⁸ Cisco says no workarounds exist, but as a temporary mitigation it advises using access control lists or firewall rules to restrict ports 22 and 830 to known controller addresses, and it recommends upgrading to a fixed release.⁸ It also tells customers to audit /var/log/auth.log for "Accepted publickey for vmanage-admin" entries from unknown addresses and to manually validate control-connection peering events.⁸

Why it matters: the same Cisco SD-WAN flaw is now tied to Lumen's Volt Typhoon zero-day findings and to Talos's key-harvesting malware, but the link between them is infrastructure overlap, not a confirmed shared operator.¹⁵⁶