Chinese state-sponsored hacking group Volt Typhoon spent nearly 3 years routing its most sensitive operations through a covert network of hijacked routers, cameras and business servers, according to research published on October 28, 2026 by Lumen’s Black Lotus Labs. The network, which Lumen calls “Silent Train,” helped the group hide at least 4 confirmed zero-day exploitation campaigns and 1 likely zero-day campaign against the platforms that organizations use to manage their networks and endpoints.
On the same day, Cisco Talos detailed a custom malware framework called KeyDrift that an espionage cluster planted on Cisco Catalyst SD-WAN controllers after exploiting CVE-2026-20127. Talos says that cluster’s infrastructure overlaps considerably with Silent Train. Together, the two reports offer one of the most detailed public looks yet at how a nation-state actor reaches, uses and protects access to the control planes of US networks.
A relay network built to vanish after each job
Lumen says it first saw consistent Silent Train activity in November 2023, shortly before US authorities disrupted the KV-botnet, an earlier network of compromised routers that Volt Typhoon used to hide its activity. Instead of rebuilding a long-lived botnet, the group moved to disposable chains of hacked devices that could be assembled for a single session and torn down afterward.
According to Lumen’s report, a typical session followed a fixed path:
- Initial VPS: a rented virtual private server outside the US, used as a short-lived staging point.
- Secondary VPS: a second server with a different provider and location to add distance from the operator.
- Overseas relays: compromised small office and home office (SOHO) routers and IoT devices in other countries.
- US exit node: a compromised device inside the US, so that traffic reaching the victim looked domestic and slipped past geo-blocking and IP reputation filters.
Lumen counted more than 27 device classes abused in these chains, from TP-Link routers and Netgear Orbi mesh systems to Fortinet appliances and CyberPanel servers. Each device type kept a fixed role for the whole 3-year observation period. Intelbras modems only appeared as overseas relays, for example, while Netgear Orbi devices only served as US hops that touched victims. Lumen says some relay device types have no known vulnerabilities, which suggests the group may have used undisclosed exploits just to recruit a single hop.
Four hours, then a clean sweep
The discipline is what sets Silent Train apart from typical proxy botnets. Operators exploited exposed web interfaces on relay devices, deployed only temporary SSH services, keys and configuration files, then removed every artifact at the end of the session. Lumen says chains could be built in under 2 minutes, which points to semi-automated provisioning. Sessions averaged about 4 hours, though some lasted only minutes.
The framework changed over time. Early chains relied almost entirely on quickly rotated consumer gear. Later, the group added enterprise systems such as Fortinet, Cisco, PRTG, Mirth Connect and CyberPanel servers as longer-lived final hops that stayed in use for 1 to 3 months. By early 2025, Lumen describes Silent Train as a hybrid network, with up to 6 hops separating the operator from the victim. Some sessions also swapped SSH hops for reverse tunnels built with the open-source proxy tools Chisel and FRP.
Session timing pointed to human operators. Activity clustered Monday through Friday between 09:00 and 22:00 China Standard Time, with little overnight or weekend work and multiweek slowdowns around Chinese New Year. Each session usually focused on 1 to 5 victims, and often on a single organization.
Five campaigns against the systems that run everything else
Lumen says Volt Typhoon probed a wide range of edge and management products through Silent Train, including Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto Networks, ServiceNow and ArcGIS. Its zero-day work, however, kept landing on the same kind of target: platforms that already hold administrative control over large fleets of devices. Breaking into one of these systems can give an attacker the reach of a full network intrusion without the noisy lateral movement.
The 5 campaigns Lumen describes are:
- Quest KACE: a likely zero-day campaign against the endpoint management suite that hit more than 30 victims and declined after Quest’s October 2025 security updates. Lumen rates its zero-day assessment as moderate confidence because logs were limited. The attackers stayed on the KACE server and used it to collect and exfiltrate credentials.
- Versa Director: SD-WAN management exploitation that Black Lotus Labs first documented in mid-2024, in which the group used an in-memory JAR webshell.
- N-able N-Central: a chain of 2 then-undisclosed flaws,
CVE-2025-8875andCVE-2025-8876, in the remote monitoring and management platform. CISA added both to its Known Exploited Vulnerabilities catalog on August 13, 2025. - Cisco Catalyst SD-WAN: exploitation of
CVE-2026-20127by late 2025, before Cisco disclosed the flaw in February 2026. Lumen says the exploitation continued well after disclosure. - VeloCloud Orchestrator: a zero-day later designated
CVE-2026-16812, an OS command injection bug in the on-premises SD-WAN orchestrator. CISA added it to the KEV catalog on July 27, 2026.
After getting in, investigators working with Lumen found in-memory webshells, credential harvesting and abuse of built-in features such as endpoint control and remote file transfer. In several cases the operators erased or altered logs to hide what they had done.
KeyDrift goes after the keys that protect branch traffic
Cisco Talos published its KeyDrift analysis the same day. Talos attributes the activity to a cluster it tracks as UAT-11473, which it calls a highly sophisticated advanced persistent threat actor targeting space and satellite services, defense and aerospace technology, and policy research. Talos describes the activity as historical and has not said when the intrusions took place.
UAT-11473 exploited CVE-2026-20127, an authentication bypass in the peering mechanism of Catalyst SD-WAN Controller (formerly vSmart), Manager (formerly vManage) and Validator (formerly vBond). Cisco’s advisory rates it 10.0 on CVSS 3.1 and says it lets an unauthenticated remote attacker log in as an internal high-privileged account and reach NETCONF to change the SD-WAN fabric’s configuration.
KeyDrift has 2 main parts:
- PolyFlame: a memory-resident module injected into the legitimate
vdaemonprocess with ptrace, launched through modified runit service scripts. It works as a TinyShell-style backdoor that can run commands, read files and write files. It can also act as an intermediate command-and-control node that relays tasking to other compromised peers. It only acts on instructions when the operator sends an MD5 hash that matches the device’s current date. - LittleFilch: a hook on
SSL_readinsidevdaemonthat reads control traffic after decryption. For a preset list of edge routers it records the public IP address, the system IP and a 32-byte field that Talos assesses is AES-256 IPsec key material the controller hands out to routers. It RSA-encrypts those records into/var/tmp/vdaemon.binand can send them over UDP in DTLS 1.2-style packets.
In practical terms, stolen data-plane keys could let an attacker who can also capture an organization’s encrypted SD-WAN traffic decrypt communication between its sites. Talos did not say whether any keys were actually sent out. It could not recover the configuration file that would have named the destination, because LittleFilch deletes it after reading.
Talos also found a packed PolyFlame variant posing as the aaamgr service on an affected Validator appliance. That loader decrypts an RC4-encrypted payload, exits if a debugger is attached and tampers with PAM configuration files. Operators also used timestomping to make malicious files look older.
Overlap is not the same as attribution
Talos says with high confidence that UAT-11473’s infrastructure “overlaps considerably” with Silent Train, but it does not say UAT-11473 and Volt Typhoon are the same group. Lumen, for its part, ties Volt Typhoon to CVE-2026-20127 exploitation but does not connect that activity to KeyDrift. Readers should treat the link between the 2 reports as a strong infrastructure overlap rather than a confirmed single actor.
The US government has publicly identified Volt Typhoon as a People’s Republic of China state-sponsored group since February 2024, warning that it was pre-positioning inside US critical infrastructure. BreachNews has previously covered China-linked hackers breaching an FBI wiretap system.
Hawaii, California and Texas in the crosshairs
Lumen says it sent hundreds of victim notifications over 3 years. Targets included US government networks, telecommunications providers, defense contractors, satellite and mission-critical communications providers, managed service providers, IT firms, universities with military ties and critical infrastructure operators in water, energy, transportation, maritime, rail, aviation and emergency services.
Between November 2023 and July 2026, targeting concentrated most heavily in Hawaii, California and Texas. Those states host major military bases, defense contractors, satellite communications and logistics networks that support US operations in the Indo-Pacific. Lumen says the pattern is consistent with efforts to keep access to systems that would matter during a crisis in the region.
What defenders should check now
Organizations running Cisco Catalyst SD-WAN should confirm they are on a fixed release for CVE-2026-20127. Cisco’s software advisory points to 20.9.8.2, 20.12.5.3 or 20.12.6.1, 20.15.4.2, and 20.18.2.1 or later, depending on the release train. Self-hosted deployments should restrict ports 22 and 830 to known controller IPs. Talos has published Snort rules for the flaw (SIDs 65938 and 65958) and for KeyDrift artifacts.
Based on the two reports, teams should also:
- Look for unexpected changes to runit service scripts under
/etc/sv/sshd/and/etc/sv/aaamgr/, and for/var/tmp/vdaemon.binon SD-WAN controllers. - Treat endpoint management, network management, SD-WAN orchestration and out-of-band platforms as top-tier assets, and keep their admin interfaces off the open internet.
- Centralize and extend log retention for internet-facing management systems, since the operators routinely wiped local logs.
- Hunt for admin logins, API calls and file transfers that fall outside normal work patterns, including activity during China Standard Time working hours.
- Replace or lock down end-of-life SOHO routers and IoT devices, which make up most of the relay layer. Earlier abuse of edge devices, such as the credential campaign against 75,000 Fortinet devices and the Check Point VPN zero-day, shows how often these systems become the first foothold.
Cisco and Lumen both urge organizations that find signs of compromise to activate incident response right away. The Chinese government had not issued any public statement on the new reports at time of publication.
