Volt Typhoon's Silent Train Used Four Zero-Days Against N-able, Cisco, Arista, and Versa Management Platforms
Volt Typhoon shifted to ephemeral device chains after KV-botnet disruptions, enabling four zero-day campaigns through management platforms. Evidence from Black Lotus shows compartmentalized operations that prioritize scalable access over direct persistence. Delayed patching of these controllers created persistent blind spots in critical infrastructure sectors.
Black Lotus Labs traced Silent Train to chains of on-demand compromised devices that delivered web shells and credential harvesters into endpoint and SD-WAN controllers. The four confirmed zero-days plus a suspected Quest KACE flaw let operators reach downstream customer networks without persistent infrastructure. Victim lists include water utilities, rail operators, and satellite providers selected for their position in control planes.
CISA: Mapping of remaining Silent Train nodes will trigger at least two additional management-platform zero-day disclosures within nine months.
Sources (3)
- [1]Lumen Black Lotus Labs Silent Train Report(https://lumen.com/blacklotuslabs/reports/silent-train)
- [2]NIST NVD Entries for CVE-2025-8875 and CVE-2026-20127(https://nvd.nist.gov/vuln/detail/CVE-2025-8875)
- [3]The Hacker News Volt Typhoon Coverage(https://thehackernews.com/2026/10/volt-typhoon-used-covert-silent-train.html)