A covert network built to disappear
Lumen's Black Lotus Labs has spent roughly three years tracking a covert relay network it calls Silent Train, first observed in November 2023, shortly before the first law enforcement takedown of Volt Typhoon's earlier KV-botnet of hijacked routers. Rather than rebuild a similarly persistent botnet after that disruption, the group shifted strategy entirely, moving to disposable chains of compromised devices that get assembled, used, and abandoned rather than maintained over time.
Each attack session in Silent Train routed traffic through roughly four devices, sometimes up to six, spread across multiple countries before finally reaching a U.S. IP address. That routing pattern defeats location-based blocking and IP reputation filtering, the two cheapest defenses most security teams rely on for exactly this kind of threat. Lumen identified more than 27 distinct device types used as relay points, and some of them had no previously known vulnerabilities at all, which is itself evidence the group is sitting on exploits nobody has disclosed yet.
Four zero-days, confirmed, and a fifth likely
Lumen confirmed Volt Typhoon exploited zero-day vulnerabilities in four separate products: Versa Director in 2024, N-able N-central through CVE-2025-8875 and CVE-2025-8876, Cisco Catalyst SD-WAN through CVE-2026-20127, a maximum-severity CVSS 10.0 flaw the group kept exploiting even after Cisco publicly disclosed it in February 2026, and VeloCloud Orchestrator through CVE-2026-16812. Continuing to exploit a flaw after public disclosure is a notable detail: it means patch adoption lagged badly enough that the group saw no reason to retire a working exploit.
Lumen also assesses, with moderate confidence, a likely fifth zero-day in Quest KACE, a vulnerability that hit more than 30 victims on its own. Lumen was careful to frame this one as an assessment rather than a confirmed finding: "the available data supports a moderate-confidence assessment that Volt Typhoon exploited a zero-day vulnerability." Five zero-days across five different network and IT management products, sustained over three years, is not the output of a team relying on luck or commodity exploit kits. It is the output of a resourced, patient program with its own vulnerability research pipeline.
The target list is the actual warning
Lumen's victim notifications, sent in the hundreds over the course of the investigation, span telecommunications companies, government agencies, defense contractors, satellite and emergency communications providers, universities with ROTC programs, managed service and IT firms, and critical infrastructure across water, energy, transportation, maritime, and rail. Hawaii, California, and Texas were the most frequently targeted locations over several years, a geography that lines up with Indo-Pacific logistics and basing rather than general-purpose espionage.
The common thread Lumen identifies across every victim category is access, specifically to larger networks or to other organizations' customers, rather than any sensitive data sitting on the compromised device itself. Managed service providers and IT firms are valuable for what they can reach on behalf of everyone they serve, which is a different and larger prize than whatever data lives on their own systems. Lumen's own framing captures this precisely: "systems with broad administrative reach can become high-value gateways to the entire organization and its customers." That sentence describes exactly the kind of vendor relationship most enterprises maintain without treating it as a security dependency.
Pre-positioning, not disruption, for now
Every public assessment of Volt Typhoon's activity, this one included, describes the group as pre-positioning inside networks tied to U.S. critical infrastructure in a way consistent with preparing for a potential conflict scenario in the Indo-Pacific, rather than causing disruption in the present. That distinction matters for how enterprises should prioritize response. This is not an active ransomware crisis demanding immediate incident response. It is a patient intelligence and access operation that activates its footholds only if and when a broader crisis arrives.
That framing can cut both ways for a CIO building a budget case. On one hand, there is no fire burning today, which makes it harder to justify emergency spending. On the other, the entire value of pre-positioning to an adversary is that defenders discover it too late to matter, during the crisis itself rather than years before it. Lumen's three-year tracking effort is itself evidence of how long this kind of access can persist undetected inside a well-run network.
Why this matters beyond direct government and infrastructure targets
Most PE-backed SaaS and retail technology leaders reading this correctly assume their own companies are not the primary target. The victim list includes managed service providers and IT firms specifically because of who else they serve, and most mid-market enterprises outsource at least some infrastructure management to exactly that category of vendor. A compromise upstream of your MSP is invisible to your own security tooling by design, because the attacker never has to touch your network directly, only the shared management plane your vendor uses to reach it.
The practical question is not whether your company looks like a Volt Typhoon target. It is whether any vendor in your supply chain, your SD-WAN provider, your remote monitoring and management tool, your IT services partner, looks like one. Asking that question of your top five infrastructure vendors this quarter, and asking for their own exposure assessment against this specific disclosure, costs nothing and surfaces risk that your own perimeter monitoring cannot see.
What to actually do with this disclosure
Audit which network management and SD-WAN products are deployed anywhere in your environment or your critical vendors' environments, specifically Versa Director, N-able N-central, Cisco Catalyst SD-WAN, VeloCloud Orchestrator, and Quest KACE, and confirm current patch levels against the specific CVEs Lumen named. If any of these products sit unpatched or past end of support, treat that as this week's priority rather than next quarter's, and ask the vendor directly whether they have seen any indicators matching the device types Lumen published, since several of the compromised device types in this campaign had no previously known vulnerabilities at all.
Beyond patching, push for genuine network segmentation between management-plane infrastructure and the production systems it administers, since Silent Train's entire value to its operators comes from devices that have broad administrative reach by design. A device that manages your network should not also be reachable from the general internet with the same privileges it uses internally, and management interfaces that must stay internet-facing for vendor support should sit behind their own additional authentication layer. That single architectural change closes off the exact pattern Lumen documented across 27 device types, regardless of which specific product your organization happens to run, and it survives the next zero-day in this category even before a patch exists.
