Volt Typhoon used Silent Train network in zero-day campaigns

# Volt Typhoon used Silent Train network in zero-day campaigns

https://gcdradar.vercel.app/incidents/volt-typhoon-used-silent-train-network-in-zero-day-campaigns · AIR-2026-1620 · closed 2026-11-12

- Lane: Breaches & attacks
- Severity: 3 (Confirmed exploitation): Confirmed zero-day exploitation campaigns by an advanced persistent threat group.
- Fix status: No fix needed
- First reported: 2026-10-28
- AI role: No AI role
- Products: SOHO and IoT enterprise infrastructure

## Summary

The China-nexus espionage group Volt Typhoon was linked to a covert access network named Silent Train, utilized for zero-day exploitation. The infrastructure leverages rotating chains of compromised SOHO, IoT, and enterprise devices.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-10-29: Cisco SD-WAN zero-day exploitation is tied to the Silent Train network and key-stealing malware. (https://securityweek.com/cisco-sd-wan-zero-day-exploitation-tied-to-volt-typhoons-silent-train-network)
- 2026-10-28: Researchers uncover Volt Typhoon’s covert, ephemeral network (https://cyberscoop.com/volt-typhoon-silent-train-covert-ephemeral-network-black-lotus-labs)
- 2026-10-28: Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns (https://thehackernews.com/2026/10/volt-typhoon-used-covert-silent-train.html)

## Sources

- 2026-10-28 The Hacker News: Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns https://thehackernews.com/2026/10/volt-typhoon-used-covert-silent-train.html
- 2026-10-28 CyberScoop: Researchers uncover Volt Typhoon’s covert, ephemeral network https://cyberscoop.com/volt-typhoon-silent-train-covert-ephemeral-network-black-lotus-labs
- 2026-10-29 SecurityWeek: Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network https://securityweek.com/cisco-sd-wan-zero-day-exploitation-tied-to-volt-typhoons-silent-train-network

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.