> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Volt Typhoon uses Silent Train relay network to exploit SD-WAN and control plane CVEs - URL: https://f4n6.co.uk/security-feed/volt-typhoon-uses-silent-train-relay-network-to-exploit-sd-wan-and-control-plane-cves/ - Published: 2026-10-29T14:33:23.000Z - Updated: 2026-10-29T14:33:23.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2024-39717, CVE-2025-8875, CVE-2025-8876, CVE-2026-20127, CVE-2026-16812, Volt Typhoon, UAT-11473 ## 1\. Executive summary Lumen Black Lotus Labs has documented Silent Train, a covert relay network that Volt Typhoon (MITRE G1017) assembles from compromised SOHO/IoT devices and enterprise appliances, uses for a single intrusion, then dismantles and restores to its original state. Through it the group ran at least four confirmed zero-day campaigns against control plane platforms: Versa Director (CVE-2024-39717, CVSS 7.2 HIGH, in CISA KEV since 2024-08-23, EPSS 4%), N-able N-central (CVE-2025-8875 and CVE-2025-8876, both CVSS 9.4 CRITICAL, in CISA KEV since 2025-08-13, EPSS 2% and 3%), Cisco Catalyst SD-WAN (CVE-2026-20127, CVSS 10.0 CRITICAL, in CISA KEV since 2026-02-25, EPSS 89%), and VeloCloud Orchestrator (CVE-2026-16812, CVSS 10.0 CRITICAL, in CISA KEV since 2026-07-27, EPSS 1%), plus a likely zero-day campaign against Quest KACE. Cisco Talos separately attributes exploitation of CVE-2026-20127 and deployment of the KeyDrift malware framework to UAT-11473, an actor with no MITRE ATT&CK profile whose infrastructure Talos says overlaps considerably with Silent Train; Talos does not state the two are the same group. For EMEA financial services the exposure is concentrated in managed SD-WAN and network management platforms that sit above segmentation and hold credentials to the estate, and every CVE named here is already in CISA KEV, so the exploitation question is settled and only the patch state is open. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ----------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 28: ICT third-party risk, general principles | The exploited products (Cisco Catalyst SD-WAN, Versa Director, VeloCloud Orchestrator, N-able N-central) are typically operated by network or managed service providers on the client's behalf, and Lumen lists MSPs among the victims | Clients must confirm which of these platforms a third party runs for them, obtain the provider's patch status for the five CVEs, and record the answer in the ICT third-party register | | DORA Art. 30: key contractual provisions with ICT third-party providers | The same outsourced control plane platforms are the ones the actor targets for persistent access and keying-material theft | Contract terms should give the client audit and incident-notification rights over provider-managed SD-WAN and management appliances, and the right to require evidence of remediation | | NIS2 Art. 21(2)(d): supply chain security measures | Silent Train's final hops are compromised enterprise appliances (Fortinet, Cisco, PRTG, Mirth Connect, CyberPanel) sitting in the supply chain between the client and its providers | Supply chain security measures must extend to the security of provider-operated edge and management infrastructure, not only to software provenance | ## 3\. Technical analysis & attack chain Silent Train is not a botnet in the persistent sense. Black Lotus Labs describes infrastructure that is assembled for a session, used, and dismantled, with compromised devices restored to their original state afterwards. The group began building it before the December 2023 takedown of the KV botnet and expanded it afterwards, adding device classes over time to more than 27 in total. It is reserved for exploitation, credential access, data exfiltration and ongoing engagement with victim environments; reconnaissance runs over separate infrastructure. Confirmed steps in a Silent Train intrusion: 1. The operator connects from a virtual private server outside the United States. 2. Traffic passes through one or more compromised overseas devices, typically SOHO routers and IoT equipment (TP-Link, Netgear, Intelbras, Zyxel, Ruckus, Cambium) exploited through their exposed web interfaces. 3. Traffic exits through one or more US-based devices before reaching the victim, which blends it with domestic traffic and defeats geo-blocking and IP reputation filtering. Black Lotus Labs observed chains of up to six hops between operator and victim. 4. The final hop is an enterprise platform (Fortinet, Cisco, PRTG, Mirth Connect, CyberPanel) positioned directly in front of the target. 5. The actor exploits a zero-day in a control plane platform to obtain administrative access without traversing the internal network. 6. Post-exploitation runs in memory: webshells, credential harvesting, and abuse of native features for endpoint control and remote file transfer. In several cases the actor erased or altered logs and other evidence of exploitation and operator activity. The relay design removes the noisiest part of an intrusion. Black Lotus Labs notes that compromising a management or orchestration platform gives the actor, in one step, what would otherwise require traversing networks, identifying administrators, locating key systems and establishing multiple footholds, with no lateral movement and few forensic artefacts. Every zero-day campaign Lumen observed through Silent Train targeted a platform of this kind. Two relay models are in use. Early chains exposed temporary SSH services on each hop and pivoted sequentially. As the network matured, some operations mixed in reverse tunnels through the open-source proxies Chisel and FRP, sending traffic from compromised devices to upstream infrastructure instead of exposing a listener on every hop. The five campaigns and their vulnerabilities: - Versa Director, through CVE-2024-39717 (CVSS 7.2 HIGH, CISA KEV since 2024-08-23, EPSS 4%). NVD classifies it as CWE-434, unrestricted upload of a file with a dangerous type. - N-able N-central, through CVE-2025-8875 (CVSS 9.4 CRITICAL, CISA KEV since 2025-08-13, EPSS 2%, CWE-502 deserialization of untrusted data) and CVE-2025-8876 (CVSS 9.4 CRITICAL, CISA KEV since 2025-08-13, EPSS 3%, CWE-20 improper input validation and CWE-78 OS command injection). - Cisco Catalyst SD-WAN, through CVE-2026-20127 (CVSS 10.0 CRITICAL, CISA KEV since 2026-02-25, EPSS 89%). NVD classifies it as CWE-287, improper authentication. Per SecurityWeek's account of Cisco's advisory, an unauthenticated remote attacker bypasses the peering authentication of SD-WAN controller components and obtains admin rights, which allows the SD-WAN configuration to be altered. Lumen reports the group was exploiting it by late 2025 and continued after Cisco's February 2026 disclosure. - VeloCloud Orchestrator, through CVE-2026-16812 (CVSS 10.0 CRITICAL, CISA KEV since 2026-07-27, EPSS 1%, CWE-78 OS command injection). - Quest KACE, possibly through an unknown zero-day. Lumen describes this campaign as likely; no CVE is associated with it. KeyDrift and UAT-11473\. Cisco Talos reports that UAT-11473 exploited CVE-2026-20127 against Cisco Catalyst SD-WAN Controller instances and deployed KeyDrift, a custom malware framework. KeyDrift is injected into legitimate control-plane processes, so it reads control traffic after decryption. It has two named modules: PolyFlame, a backdoor that can also relay commands to other hosts as an intermediate command-and-control node, and LittleFilch, which collects keying material that Talos believes includes the keys protecting data-plane traffic. The framework gives persistent access to the controllers and extracts and exfiltrates control-session metadata and data-plane keying material. Talos describes UAT-11473 as targeting space and satellite services, defense and aerospace technology, and policy research, and calls the activity historical without giving dates. Attribution caveats. Volt Typhoon has a MITRE ATT&CK profile (G1017). UAT-11473 does not, and the link between it and Volt Typhoon rests on Talos's high-confidence assessment that the two sets of infrastructure overlap considerably. Talos does not say they are the same group, and Lumen's report does not mention KeyDrift or UAT-11473 at all. Treat the KeyDrift activity as conducted by an actor whose identity relative to Volt Typhoon is unconfirmed, and treat the overlap as single-sourced to Talos. The broader claim that Silent Train was used against Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto, ServiceNow and ArcGIS is also single-sourced to Lumen, and Lumen could not always determine whether known or unknown vulnerabilities were exploited in those cases. Victimology. Lumen's monitoring produced hundreds of victim notifications over three years. Sessions were narrow, typically one to five victims and often a single organisation. Victims include US government entities, telecommunications providers, defense contractors, satellite and mission-critical communications providers, MSPs, IT firms, universities with military affiliations, and critical infrastructure operators in water, energy, transportation, aviation and emergency services. Hawaii, California and Texas were the most frequently targeted states. Mike Horka of Black Lotus Labs told journalist Kim Zetter that the group has also exfiltrated documents on military operations and network structures, and he assesses the activity as combining pre-positioning with espionage. No EMEA victim is named in any source. ## 4\. Mitigation & containment P1, within 24 hours. - Inventory every instance of Cisco Catalyst SD-WAN Controller, Versa Director, VMware VeloCloud Orchestrator, N-able N-central and Quest KACE reachable from the internet or from partner networks. CVE-2026-20127 carries EPSS 89% and a CVSS of 10.0 with unauthenticated admin access, so treat any unpatched Catalyst SD-WAN Controller as compromised until proven otherwise. - Patch CVE-2026-20127, CVE-2026-16812, CVE-2025-8875, CVE-2025-8876 and CVE-2024-39717 to the fixed versions named in each vendor's advisory. All five are in CISA KEV; the KEV listing confirms exploitation, and the vendor advisories are the source for fixed builds, which this item does not reproduce. - On Catalyst SD-WAN, rotate controller credentials and any data-plane keying material after patching. KeyDrift's LittleFilch module exists to collect that material, so a patched controller with unchanged keys remains exposed. - Hunt controller and orchestrator hosts for in-memory webshells and for processes that should not be listening. Lumen reports webshells held in memory and log erasure, so on-disk file scans and log review alone will miss both. - Restrict management interfaces of SD-WAN controllers, orchestrators and N-central to named administrative networks. CVE-2026-20127 is an authentication bypass on the peering path, so network placement of the controller matters as much as the patch. P2, within 72 hours. - Review logs on the five platforms for gaps, truncation or altered timestamps covering the period since late 2025\. The actor erased or altered evidence in several cases; absence of logs on these hosts is itself a finding. - Search for Chisel and FRP binaries and for reverse-tunnel traffic leaving edge devices. These are legitimate open-source tools, so detection depends on context: an FRP or Chisel client on a router, appliance or management server with no change record. - Audit SOHO and IoT devices on your estate and at remote sites for exposed web administration interfaces, and disable remote management from the internet on TP-Link, Netgear, Zyxel, Ruckus and Cambium equipment. These are the relay hops, and a compromised one is used for a single session and then restored, so it will not appear in later scans. - Ask every MSP and network provider that operates any of the five platforms for written confirmation of patch state and of whether KeyDrift indicators were hunted. Lumen lists MSPs among the victims. P3, within 7 days. - Add the Silent Train pattern to network monitoring: sessions whose path runs from foreign VPS infrastructure through overseas consumer or IoT address space and exits via US hosts before reaching a management platform. Geo-reputation filtering alone will not catch this because the final hop is domestic. - For Quest KACE, no CVE exists. Restrict its management interface to administrative networks and monitor it for the same in-memory webshell and credential-harvesting behaviour until a vendor fix is available. - Review DORA Art. 28 and Art. 30 records for these platforms as set out in section 2. ## 5\. Indicators of compromise No atomic indicators (hashes, domains, IP addresses, file paths) are present in the source material. The sources describe behaviours and named tooling only. Behavioural indicators: | behaviour | where to observe | confidence | | ----------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------- | | In-memory webshells on control plane platforms, with no corresponding file on disk | SD-WAN controllers, orchestrators, N-central and KACE hosts: process memory and web server worker processes | High, reported by Lumen from post-incident analysis with partners | | Credential harvesting and abuse of native endpoint control and remote file transfer features | EDR and platform audit logs on the same hosts | High, Lumen | | Erasure or alteration of logs and other evidence of exploitation and operator activity | Log integrity checks on the five platforms; gaps in audit trails | High, Lumen | | Reverse tunnels via Chisel or FRP from edge devices and appliances to upstream infrastructure | Egress network monitoring on routers, appliances and management servers | Medium, Lumen describes the technique but publishes no tool configuration | | KeyDrift injected into legitimate control-plane processes, with PolyFlame backdoor and LittleFilch keying-material collection | Cisco Catalyst SD-WAN Controller process memory and outbound connections from controller processes | Medium, single-sourced to Cisco Talos; verify before enforcement | | Relay chains of up to six hops from foreign VPS through overseas SOHO/IoT devices, exiting via US hosts | NetFlow and proxy logs on management platform ingress | Medium, Lumen describes the pattern but publishes no addresses | No copyable indicator block is provided because the sources contain no atomic indicators. ## 6\. Detection The sources name tooling and modules but publish no strings, filenames, mutexes, registry keys or command lines from the malware itself. A YARA rule built on the names KeyDrift, PolyFlame or LittleFilch would detect reporting about the threat rather than the threat, so none is emitted. Insufficient indicators to author detection rules. ## CVE assessment 5 referenced CVEs — **5 actively exploited (CISA KEV)**, 4 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ------------- | ---------------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-20127](https://nvd.nist.gov/vuln/detail/CVE-2026-20127?ref=f4n6.co.uk) | 10.0 Critical | ⚠ KEV 2026-02-25 | 89% | A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WA… | | [CVE-2026-16812](https://nvd.nist.gov/vuln/detail/CVE-2026-16812?ref=f4n6.co.uk) | 10.0 Critical | ⚠ KEV 2026-07-27 | 1% | VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged int… | | [CVE-2025-8875](https://nvd.nist.gov/vuln/detail/CVE-2025-8875?ref=f4n6.co.uk) | 9.4 Critical | ⚠ KEV 2025-08-13 | 2% | Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central… | | [CVE-2025-8876](https://nvd.nist.gov/vuln/detail/CVE-2025-8876?ref=f4n6.co.uk) | 9.4 Critical | ⚠ KEV 2025-08-13 | 3% | Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 20… | | [CVE-2024-39717](https://nvd.nist.gov/vuln/detail/CVE-2024-39717?ref=f4n6.co.uk) | 7.2 High | ⚠ KEV 2024-08-23 | 4% | The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available f… | ## Threat actor context **Volt Typhoon** · [G1017](https://attack.mitre.org/groups/G1017?ref=f4n6.co.uk) · aka BRONZE SILHOUETTE, Vanguard Panda, DEV-0391, UNC3236, Voltzite [Volt Typhoon](https://attack.mitre.org/groups/G1017?ref=f4n6.co.uk) is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021, primarily targeting critical infrastructure organizations in the US and its territories including Guam. … *No MITRE ATT&CK profile for: UAT-11473.* ## 7\. Sources - Help Net Security, "Volt Typhoon targeted enterprise control planes via ever-changing 'Silent Train' relay network", https://www.helpnetsecurity.com/2026/10/29/volt-typhoon-silent-train-relay-network/, 2026-10-29 - SecurityWeek, "Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon's 'Silent Train' Network", https://www.securityweek.com/cisco-sd-wan-zero-day-exploitation-tied-to-volt-typhoons-silent-train-network/, 2026-10-29 - The Hacker News, "Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns", https://thehackernews.com/2026/10/volt-typhoon-used-covert-silent-train.html, 2026-10-29 - Lumen Black Lotus Labs report on Silent Train and Cisco Talos report on UAT-11473 and KeyDrift are cited by the above; neither primary report URL is given in the source material. ## 8\. Adverse Trace position Adverse Trace assesses this as high priority for any EMEA financial services client running Cisco Catalyst SD-WAN, Versa Director, VeloCloud Orchestrator or N-able N-central, on the strength of the verified severity and KEV status rather than the reporting: CVE-2026-20127 is CVSS 10.0 with EPSS 89% and unauthenticated admin access, and all five CVEs are in CISA KEV. The KeyDrift attribution to UAT-11473 and its overlap with Volt Typhoon is single-sourced to Cisco Talos and unconfirmed, and we will not treat the two as one actor until a second source corroborates it. No EMEA victim is named, so client impact is assessed from platform exposure, not from observed targeting. We will request the primary Lumen and Talos reports for atomic indicators, re-issue this advisory if any are published, and contact clients running the affected platforms directly to confirm patch state and key rotation on Catalyst SD-WAN controllers. --- [Read the original source →](https://www.helpnetsecurity.com/2026/10/29/volt-typhoon-silent-train-relay-network/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*