Cybersecurity

Volt Typhoon's 'Silent Train' hit four management platforms, and likely a fifth. Check the patches

3 min read

Blueprint-style network diagram of routers, servers and edge appliances, four highlighted in amber, with faint dashed chains travelling along the links, for Volt Typhoon's Silent Train campaign.

Lumen says Volt Typhoon's Silent Train relay network backed confirmed zero-day attacks on Versa, N-able, Cisco and VeloCloud, and likely Quest KACE. Fixes exist for most listed CVEs, though Arista has not yet named a fixed VeloCloud Orchestrator 7.0 build.

In brief

Developing. Last updated 29 October 2026, 16:09 Dubai time (UTC+4).

Lumen's Black Lotus Labs published research on 28 October describing Silent Train, a covert network Lumen first identified in late 2023. It routes sessions through short-lived chains of compromised devices. Lumen says its monitoring led to hundreds of victim notifications and uncovered four confirmed zero-day campaigns and one likely one, all against platforms that manage other devices.

The same day, Cisco Talos described UAT-11473, an actor that exploited Cisco SD-WAN flaw CVE-2026-20127 to plant a key-stealing framework it calls KeyDrift. Talos assesses with high confidence that UAT-11473's infrastructure "overlaps considerably" with Silent Train. It does not say the two are the same actor, and neither do we.

Patch status, checked 29 October 2026

  • N-able N-central (CVE-2025-8875, CVE-2025-8876). Fixed in N-central 2025.3.1 (13 August 2025), per N-able and NVD. N-able says exploitation requires authentication. Both are in CISA's Known Exploited Vulnerabilities (KEV) catalogue.
  • Cisco Catalyst SD-WAN (CVE-2026-20127, CVSS 10.0). An unauthenticated authentication bypass in the SD-WAN Controller, Manager and Validator, disclosed 25 February 2026. First fixed releases include 20.9.8.2, 20.12.5.3 or 20.12.6.1, 20.15.4.2 and 20.18.2.1. Releases 20.11, 20.13, 20.14 and 20.16 are past maintenance and must move to a fixed train. Cisco says there are no workarounds. Lumen says exploitation continued long after disclosure.
  • Arista VeloCloud Orchestrator (CVE-2026-16812, CVSS 10.0). Arista's advisory of 27 July 2026 says the on-premises flaw was actively exploited. It is fixed in VCO 5.2.3.14, 6.1.3.4 and 6.4.2.4 and later in each train. Arista lists 7.0.x before 7.0.0.1 as affected but its fixed list does not yet name a 7.0 build.
  • Quest KACE (suspected). Lumen assesses with moderate confidence that a zero-day was used, but limited logs prevented it from identifying the flaw. It says activity declined after Quest's October 2025 security updates. No CVE is attributed.

Cisco's hardening and hunting guidance

Cisco advises auditing /var/log/auth.log for "Accepted publickey for vmanage-admin" entries from unrecognised addresses, then checking them against configured System IPs. It also asks customers to manually validate every control-connection peering event, especially vmanage peer types, against maintenance windows, asset inventories and expected device roles. Until upgrades are complete, on-premises customers should restrict ports 22 and 830 to known controller IPs. Cisco also advises keeping control components off the internet behind filtering devices, and sending logs to an external server with long retention. Suspected compromises should go to Cisco TAC with request admin-tech output.

What leaders should do next

  1. Treat management planes as crown jewels. Every campaign Lumen lists hit a platform with administrative reach over many other systems.
  2. Confirm versions, not tickets. Check each platform's running build against the fixed releases above. For CVE-2026-20127, unsupported trains need an upgrade, not a patch.
  3. Hunt as well as patch. Review logs from before the patch date, and rotate credentials and keys held on any platform found exposed.

Sources and scope

Primary sources, all read on 29 October 2026: Lumen Black Lotus Labs, Silent Train (28 October 2026); Cisco Talos, Inside KeyDrift (28 October 2026); Cisco's CVE-2026-20127 advisory (version 2.1, 28 October 2026); Arista Security Advisory 0144; N-able's N-central 2025.3.1 release notice; and NVD entries for CVE-2025-8875, CVE-2025-8876, CVE-2026-20127 and CVE-2026-16812. SecurityWeek and BleepingComputer were used as secondary reporting only. Attribution to Volt Typhoon is Lumen's. The Quest KACE zero-day is Lumen's moderate-confidence assessment and has not been confirmed by Quest; we did not check Quest's advisories. Technical exploitation detail is deliberately omitted. The prioritisation and recommended actions are ByteNib editorial analysis.

Drafted with AI assistance and reviewed by the editor before publication.

Continue exploring: Cybersecurity analysis, the related implementation tutorial, and the structured learning path.