Volt Typhoon used Silent Train to conceal intrusions into critical U.S. networks, according to Lumen research released October 28, 2026. Black Lotus Labs linked the infrastructure to four confirmed zero-day campaigns against enterprise management platforms.

CyberScoop reported that the China-backed group's victims included telecommunications providers, government entities, defense contractors and essential services. Researchers notified hundreds of victims during the investigation, underscoring the reach of a campaign that developed over several years.

Lumen describes temporary chains of compromised routers, connected devices and enterprise systems. Attackers routed traffic through overseas infrastructure and U.S. relays, exploited exposed web interfaces and installed temporary SSH tooling. Sessions averaged about four hours before operators dismantled the chains and removed artifacts.

The primary report identifies confirmed zero-day campaigns involving Versa Director, N-able N-central, Cisco Catalyst SD-WAN and VeloCloud Orchestrator. A separate Quest KACE case remains a moderate-confidence assessment because limited logs prevented identification of the underlying vulnerability.

Lumen says targeting management platforms provides administrative access and visibility across enterprise and customer environments. It recommends restricting exposed administration interfaces, prioritizing patches and reviewing permissions and trusted connections.

Defenders should also centralize logs, extend retention and investigate unusual administrative activity, Lumen advises. In an interview with CyberScoop, researcher Michael Horka explained that continuously rebuilt infrastructure makes disruption difficult because there is no single enduring network to dismantle.