Every Zero-Day in Volt Typhoon's Silent Train Was Already on CISA's Must-Patch List. The Oldest Deadline Passed Two Years Ago.
Black Lotus Labs, the threat research arm of Lumen, published a report yesterday on a relay framework they call Silent Train, which they have tracked for three years. It is Volt Typhoon's method for hiding where its intrusions come from: chains of compromised edge devices used as hops — Intelbras modems as overseas relays, Netgear Orbi routers as US hops — with activity routed through VPS infrastructure outside the United States and the tooling removed after each operation.
Targets named in the reporting: telecommunications, government agencies, defense contractors, educational institutions, utilities and critical infrastructure, satellite providers, IT firms and managed service providers, transportation, aviation and emergency services. Heaviest concentration in California, Texas and Hawaii.
The relay framework is the interesting half for researchers. The entry list is the interesting half for anybody who has to defend something, and it is the half most coverage is skipping.
So we did the join. We took every zero-day named in the Silent Train reporting and looked it up in CISA's Known Exploited Vulnerabilities catalog — the only vulnerability list that arrives with a federal deadline attached. Catalog version 2026.10.28, 1,762 entries, pulled directly from the public JSON feed.
All five are already on it. Four of the five deadlines passed before yesterday's report was published.
The five
CVE-2024-39717 — Versa Director. Added to KEV August 23, 2024. Remediation due September 13, 2024. That deadline is 776 days old.
CVE-2025-8875 — N-able N-Central. Added August 13, 2025. Due August 20, 2025.
CVE-2025-8876 — N-able N-Central. Added August 13, 2025. Due August 20, 2025.
CVE-2026-20127 — Cisco Catalyst SD-WAN Controller and Manager. Added February 25, 2026. Due February 27, 2026.
CVE-2026-16812 — Arista VeloCloud Orchestrator. Added July 27, 2026. Due July 30, 2026. The newest of them, and three months past its deadline.
There is no zero-day here in the sense most readers will take from the headline. Every one of these was publicly known, vendor-patched, federally mandated and on a deadline before this campaign's reporting landed. "Zero-day exploitation campaign" is accurate about what the operator did at the time of use and misleading about what you should do now, which is not panic about an unknown bug. It is to go and check whether you did the thing you were told to do in 2024.
Notice what kind of products these are
Versa Director. N-able N-Central. VeloCloud Orchestrator. Cisco Catalyst SD-WAN Manager.
Not firewalls. Not VPN concentrators. Not the appliances that show up in every edge-security roundup. These are management planes — the consoles that configure fleets of other devices. An SD-WAN orchestrator and an MSP's remote monitoring platform are not interesting because of the data on them. They are interesting because of what they are authorized to do to everything downstream.
That is the same shape as the firewall campaign we wrote about this morning, where the operator's prize was not the firewall they landed on but the internal management server holding the configurations and credentials for every firewall that organization managed. One box that configures a thousand boxes is worth a thousand boxes, and an actor whose stated purpose is pre-positioning inside critical infrastructure is going to value that arithmetic more than a credential dump.
N-able N-Central deserves its own sentence, because it is an MSP platform. Compromising one is compromising the tooling that reaches into every client that MSP serves — which is precisely the set of small organizations with no security team, the ones we spend most of our time worrying about. Two of the five are N-central, both listed the same day, both due a week later, in August 2025.
What we could not see, and what we did about it
Here is the part where we have to be honest about our own instruments, because the number we had looked like good news and was not.
We run canaries at our edge: decoy endpoints for appliance products that answer a scanner with a convincing login page instead of a 404, so we learn that somebody is hunting a given product and when. We checked our edge telemetry for the Silent Train product shapes across every instrument we own — edge blocks, edge canaries, origin honeypot — over the window since August 1.
Zero hits. In 70,005 edge blocks, 82,642 canary records and 5,213 origin captures.
That zero is not evidence that nobody is scanning for these products. Our own checking tool prints the reason in its own output: no canary for a product means it cannot appear here. We had a Cisco pack, so Catalyst SD-WAN Manager was covered — our edge answers /dataservice/ with a vManage decoy and has since October 13. We had nothing for Versa Director, nothing for N-able N-central, nothing for VeloCloud. Those three were not quiet. They were invisible, and a zero from a sensor that cannot fire is not a measurement, it is an absence of one.
So we built the pack: decoys for Versa Director, N-able N-central and VeloCloud Orchestrator, each answering in the shape the real product answers — a JSON 401 on the Versa VNMS API, an XML session-expired on N-central's file surface, login pages where login pages belong. Before shipping we checked every proposed path against both of our own zones to make sure a decoy could not shadow a real route, and we left the generic ones alone on purpose. /portal/ is a real VeloCloud fingerprinting path and we do not trap it, because it collides with too much of the ordinary web; that costs us one detection axis and we would rather lose the axis than break somebody's site.
We are publishing this after that code is deployed and verified, not before, which is our standing rule: research that names our own blind spot gets fixed first. Verified means we went and pulled the paths off the live edge afterward rather than trusting the deploy log — the Versa console, the VNMS API's JSON 401, the N-central login, the N-central file surface's XML session-expired and the VeloCloud console all answer with the decoy, and /health, the public stats API, the pricing page, the blog and our operations dashboard all still return 200. A decoy that shadows a real route is a worse outcome than the blind spot it was meant to close, so that regression check is not optional.
The honest limit on what we built: CVE-2026-16812's exploit detail is not public to us, so our VeloCloud decoy records that somebody came looking, not what they tried. For Versa we can tell a plain probe from the favicon-upload path that became the VersaMem implant, and for N-central we can spot a Java serialized object or a shell substitution in a request. For VeloCloud we can only say: someone was here. We would rather ship that and say so than invent a marker to make the table look complete.
What to do, in the order that matters
Check the five CVEs against your estate today. Not because they are new — because they are old, and four of five deadlines are long past, and this report is evidence that an actor is still finding unpatched instances. If you are a federal agency these were already binding. If you are not, they were already free advice.
Find your management planes and get them off the public internet. Your SD-WAN orchestrator, your RMM console, your appliance manager. These should be reachable from an administrative network or through an identity-aware proxy, not from anywhere. This is the control that survives the sixth CVE, and there will be a sixth.
If you are an MSP, treat your N-central as a crown jewel, because it is one. Your clients' security is bounded above by it.
If you are a client of an MSP, ask them about those two CVEs by number. The answer, and the speed of the answer, tells you more about that relationship than any questionnaire will.
Watch for the relay shape, not just the entry. Silent Train is compromised small-business and consumer edge hardware used as hops. Traffic from a residential or small-office address that behaves like an administrator is the tell, and it will not look like an attack from a country you expected, which is the entire point of the framework. Our free blocklist is one of the lists you can point at that egress: the IP, domain and hash feeds are at analytics.dugganusa.com/api/v1/stix-feed. Registration takes about thirty seconds, no sales call, and you set the confidence floor rather than us.
Limits
The Silent Train research is Black Lotus Labs' work, carried here from secondary reporting. We have not independently verified the campaign, we have not seen their telemetry, and we hold no indicators from it — the reporting we have read names no IP addresses, domains or file hashes we could ingest, so there is nothing from this campaign in our feed and we are not implying there is. If and when they publish indicators, we will ingest what is attributable and say so.
The reporting describes "at least four" zero-days while naming five CVEs plus a suspected Quest KACE issue that is not confirmed. We have listed the five that carry CVE identifiers and left the Quest KACE item out, because a suspected zero-day is not a finding.
The KEV dates, due dates and product names are CISA's, from catalog version 2026.10.28 read today. Re-pull it; that is why we named the version. Note that CISA lists CVE-2026-16812 under Arista VeloCloud Orchestrator, reflecting the product's ownership today rather than the VMware branding most coverage uses.
Our edge figures — 70,005 blocks, 82,642 canary records, 5,213 origin captures since August 1, zero matching these product shapes — are ours and you cannot verify them from outside, which makes them the weakest claim here even though we are certain of them. More importantly, that zero was produced by sensors that could not fire for three of the four products, so it says nothing about real-world scanning volume. It is a statement about us, not about the internet.
We are not attributing anything ourselves. The Volt Typhoon attribution is Black Lotus Labs' and the targeting description is theirs.
Five percent of this is wrong somewhere. It always is.
Was this useful? Rate this post — the widget is at the bottom of the page, and we read every response. If you run Versa, N-central or VeloCloud and went and checked a date because of this, that is the reply we want most.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments