October 29, 2026
- Volt Typhoon runs its high-value intrusions through Silent Train, a relay framework of on-demand compromised devices that Lumen's Black Lotus Labs has tracked for three years. Operations route through non-US VPS, then hacked devices — Intelbras modems as overseas relays, Netgear Orbi as US hops — with temporary relays cleaned up after each operation and some enterprise hops persisting for months. Black Lotus confirmed at least four zero-days exploited through it (CVE-2026-16812 VeloCloud Orchestrator, CVE-2026-20127 Cisco Catalyst SD-WAN, CVE-2025-8875/CVE-2025-8876 N-able N-central, CVE-2024-39717 Versa Director) plus a suspected Quest KACE zero-day; targeting concentrates on California, Texas and Hawaii. The build-out followed the FBI's disruption of KV-Botnet (BleepingComputer, Lumen). · Threat Activity