If you read only one threat report this week, make it this one. Lumen's Black Lotus Labs published research on Silent Train, a covert access network it attributes to Volt Typhoon, the China-linked group that U.S. agencies have been warning about for years. The headline is the zero-days. The lesson is what they were pointed at.
What Silent Train Is
This isn't a botnet in the usual sense. Black Lotus Labs says it first saw consistent activity in November 2023, right before the KV-botnet takedown, and that Volt Typhoon shifted to something harder to see:
- Short-lived chains, built on demand. Operators exploit a few devices, use them for one operation, wipe their tracks, and build a new chain next time.
- Four to six hops on average. Overseas VPS, then compromised devices outside the U.S., then compromised devices inside the U.S., then the victim. So the connection your logs see comes from a home router in the same country.
- More than 27 device classes. TP-Link, Netgear Orbi, Zyxel, Ruckus, Cambium, Cisco, Fortinet FortiGate and others. Some relay types had no known vulnerabilities, which Black Lotus Labs reads as a sign of undisclosed zero-days.
- Clean up after every session. Temporary SSH services and keys, living-off-the-land tools, reverse tunnels with Chisel and FRP in later versions, then everything gets removed.
- Office hours. Activity clusters on weekdays, 09:00 to 22:00 China Standard Time, with breaks for Chinese New Year. Humans at keyboards, not automation.
The Zero-Day Campaigns
The researchers tie Silent Train to four confirmed zero-day campaigns and one likely one:
- Versa Director (CVE-2024-39717), mid-2024, an SD-WAN management platform used to reach downstream customers.
- N-able N-central (CVE-2025-8875 and CVE-2025-8876), a remote monitoring and management platform.
- Cisco Catalyst SD-WAN Controller (CVE-2026-20127, CVSS 10.0), exploited by late 2025 and still after Cisco's February 2026 disclosure.
- Arista VeloCloud Orchestrator (CVE-2026-16812), the SD-WAN controller bug I wrote about on Monday.
- Quest KACE (likely, moderate confidence), more than 30 victims, tapering off after Quest's October 2025 updates. Limited logs meant nobody could pin down the exact flaw.
Targets: telecoms, government, defense contractors, satellite communications, MSPs, universities with defense ties, and critical infrastructure. Hawaii, California and Texas got the most attention. Black Lotus Labs says it sent hundreds of victim notifications over three years and reads the activity as pre-positioning, not disruption. Yet.
Look at That List Again
Every product on it is a management or control plane. SD-WAN orchestrators. RMM tools. Endpoint management. These are the systems that push config and code to everything else, which is exactly why they're worth a zero-day. Compromise one VeloCloud Orchestrator and you don't own a box, you own a WAN. Compromise an MSP's N-central and you own its customers.
I keep writing some version of this sentence, and I'll keep writing it until it stops being true: your management plane is the most valuable thing on your network, and it's usually the least defended. It's internet-facing because it's convenient. It's trusted by everything downstream because that's its job. And it often keeps the worst logs, which is how a five-campaign operation stays quiet for three years.
The relay design matters too. When the last hop is a residential router in Texas, "block connections from foreign IPs" isn't a control. Neither is "trust traffic from inside the country." Location tells you almost nothing anymore. Identity, device posture and behavior are what's left.
(Usual disclosure: I work at Zscaler, which sells zero trust access. Every vendor ships bugs, mine included.) The architecture question is how much of your management plane an attacker can reach from the internet in the first place.
What To Do
- Inventory every internet-facing admin interface. SD-WAN orchestrators, RMM, endpoint management, out-of-band management, firewall consoles. If it can reconfigure other things, it shouldn't be reachable by the whole internet.
- Put management access behind identity. Strong, phishing-resistant authentication and device checks in front of admin consoles, through a broker, a jump host or a dedicated management network.
- Patch control plane software first. Not last because it's "just internal tooling."
- Keep the logs, and keep them somewhere else. Centralize and extend retention on admin platforms. Quest KACE showed what happens when the logs aren't there.
- Hunt for trusted-tool abuse. Unusual admin logins, API calls, file transfers and config changes, especially outside your business hours.
- Replace end-of-life SOHO gear. Those are the relays. Retired routers in branch offices and home offices are someone else's infrastructure now.
- Read CISA's guidance. Black Lotus Labs points to AA24-038A on Volt Typhoon and AA26-113A on China-nexus covert networks of compromised devices.
Bottom Line
Volt Typhoon didn't burn five zero-days to get into one company. It burned them to get into the systems that manage lots of companies. If your orchestrator, RMM or endpoint manager is reachable from the internet, it's on somebody's target list. Hide it, lock it behind identity, and log it like it's the crown jewel, because it is.
Sources: Lumen Black Lotus Labs, Silent Train, The Hacker News, and GBHackers