Volt Typhoon Hackers Exploit Multiple Zero-Days to Breach U.S. Critical Infrastructure Networks

Chinese state-sponsored hacking group Volt Typhoon has exploited multiple previously unknown vulnerabilities in enterprise management platforms to penetrate strategically significant organizations.

Its investigation exposed Silent Train, a covert access framework built from rapidly rotating chains of compromised devices.

Over three years, Black Lotus Labs issued hundreds of victim notifications, helping investigations uncover four confirmed zero-day campaigns and one likely campaign.

The central finding is consequential: rather than navigating enterprise networks host by host, Volt Typhoon targeted centralized systems that already possessed administrative access, credentials and trusted connections to downstream environments.

Silent Train routed operations through overseas virtual private servers and compromised non-U.S. devices before reaching domestic relay nodes near American targets.

These U.S. exit points helped malicious traffic blend into legitimate activity and evade geographic restrictions.

Researchers observed more than 27 device classes, including SOHO routers, IoT equipment and enterprise appliances.

Operators could assemble relay chains in under two minutes, conduct targeted activity and remove temporary SSH services, keys and configuration artifacts afterward.

Sessions averaged approximately four hours, although some lasted only minutes. Device roles remained compartmentalized: Intelbras modems appeared as overseas relays, while Netgear Orbi devices operated as U.S. hops communicating with victims.

By early 2025, the architecture incorporated compromised enterprise platforms that remained available for one to three months.

Traditional SSH chains operated alongside reverse tunnels using Chisel and FRP, sometimes placing six intermediary hops between operators and victims.

Silent Train Researchers said that, the framework supported operations against telecommunications providers, government agencies, defense contractors, universities, and critical infrastructure operators.

Zero-Days Exploited

The campaigns concentrated on endpoint management, network administration and software-defined wide area network orchestration.

Compromising these control planes offered broad visibility and privileged functionality while reducing lateral movement and associated forensic evidence.

In Quest KACE environments, more than 30 victims were affected. Limited logging prevented identification of the underlying vulnerability, leaving the zero-day assessment at moderate confidence.

Researchers observed credential theft and exfiltration directly from management servers.

Other campaigns involved Versa Director and N-able N-central. N-able’s release notes confirm that CVE-2025-8875 and CVE-2025-8876 require authentication and were addressed in N-central 2025.3.1, an important distinction from unauthenticated entry points.

Volt Typhoon also exploited Cisco Catalyst SD-WAN vulnerability CVE-2026-20127. Cisco rates the authentication bypass at CVSS 10.0; successful exploitation provides privileged access and can enable SD-WAN configuration manipulation through NETCONF. Cisco disclosed the issue on February 25, 2026.

VeloCloud Orchestrator became another target through CVE-2026-16812. Arista’s advisory describes a CVSS 10.0 command-injection vulnerability reachable without tenant or operator credentials and confirms active exploitation.

Targeting repeatedly concentrated in Hawaii, California and Texas, spanning communications, logistics, defense and essential services.

Black Lotus Labs assesses the pattern as consistent with pre-positioning access within ecosystems important during Indo-Pacific crises, rather than evidence of an observed disruptive attack.

Defenders should prioritize management infrastructure: remove unnecessary internet exposure, deploy vendor fixes, restrict administrative access and preserve telemetry outside potentially compromised appliances.

Cisco specifically recommends reviewing unauthorized “Accepted publickey for vmanage-admin” events and validating control-plane peering connections.

For VeloCloud deployments, Arista advises preserving access, application, system and database logs before remediation where feasible.

Suspected compromises also warrant credential rotation, managed-device validation and restoration from trusted sources not patching alone.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.