Black Lotus Labs Details Volt Typhoon’s Silent Train and Zero-Day Campaigns

Mar 16, 2026 · Original article ↗

Summary

Black Lotus Labs says Volt Typhoon used Silent Train, rotating chains of compromised devices, to reach enterprise management and SD-WAN platforms. Its three-year monitoring identified four confirmed and one likely zero-day campaigns.

Key points

Black Lotus Labs says it observed Silent Train from November 2023: rotating chains of compromised SOHO, IoT and enterprise devices used to route activity toward selected targets.
The framework used temporary VPS staging, multi-hop SSH chains and, in some operations, reverse tunnels. Operators reportedly cleaned up artifacts after sessions; investigators observed more than 27 device classes.
Black Lotus Labs reports four confirmed and one likely zero-day campaigns targeting endpoint and network management systems, SD-WAN orchestrators and other enterprise control-plane platforms.
The article describes exploitation of N-able N-central vulnerabilities CVE-2025-8875 and CVE-2025-8876, Cisco Catalyst SD-WAN vulnerability CVE-2026-20127, and a VeloCloud Orchestrator zero-day later designated CVE-2026-16812.
For Quest KACE, the article reports more than 30 affected victims and a moderate-confidence assessment that Volt Typhoon exploited a previously undisclosed flaw; the actor reportedly used the platform’s administrative capabilities to obtain and exfiltrate credentials.
Partner investigations reportedly found in-memory webshells, credential harvesting, abuse of native platform features, and erased or altered logs.
Reported targets included government, defense, telecommunications, managed service providers and critical infrastructure. Recommendations include reducing internet exposure, prioritizing patches, strengthening access controls, retaining logs and monitoring administrative activity.

Article Details

Attack Vectors: Volt Typhoon exploited exposed web interfaces and vulnerabilities in SOHO, IoT, and enterprise devices to establish short-lived relay nodes.
The group routed operations through chains of VPSs and compromised devices, including SSH hops and, in some operations, reverse tunnels using Chisel or FRP.
Campaigns exploited enterprise management and control-plane platforms, including endpoint management, network management, out-of-band administration, and SD-WAN systems.
After exploiting Versa Director, Volt Typhoon used an in-memory JAR webshell and platform features to access downstream customers.
On Quest KACE, the actor used administrative capabilities to obtain and exfiltrate credentials without moving laterally through the enterprise network.
Operators removed artifacts and dismantled relay chains after sessions; post-incident investigations also found cases of erased or altered logs.
Defensive Notes: Apply heightened security controls to management systems, SD-WAN orchestrators, out-of-band platforms, and other centralized administration technologies.
Review permissions, trust relationships, and downstream access granted through management platforms.
Inventory and minimize internet-facing systems; restrict administrative interfaces through VPNs, access-control policies, jump hosts, or dedicated management networks.
Prioritize rapid patching of internet-facing administrative platforms and vulnerabilities affecting centralized management and control-plane technologies.
Centralize logging, extend retention, and export security telemetry, especially for systems with elevated administrative access.
Monitor unusual administrative logins, abnormal API usage, remote file transfers, configuration changes, and suspicious live-off-the-land activity.
Assess how systems and trust relationships could provide access to customer, partner, government, defense, or critical-infrastructure environments.