Own the Console, Skip the Plant: What Volt Typhoon’s Silent Train Teaches OT Defenders

Amigos, picture this. A burglar doesn’t pick the lock on every house on your street. He steals the property manager’s master key ring instead. One theft, every door.

That’s the story Lumen’s Black Lotus Labs told on October 28 when it published its research on “Silent Train,” which it describes as a covert operational framework used by Volt Typhoon. And the doors in this story are the management platforms a lot of OT networks quietly lean on every single day.

What actually happened

According to Lumen, Silent Train has been running since at least November 2023, shortly before the first KV-botnet takedown. It’s a relay system built from what Lumen calls “rapidly rotating chains of compromised SOHO, IoT and enterprise devices that are exploited on demand, used against carefully selected targets, cleaned up after each operation and continuously refreshed.”

Lumen counted more than 27 device classes. The chains could run up to six hops, with a compromised US device as the last stop before the victim, so the traffic looked domestic. Operators could build a chain in under two minutes, sessions averaged about four hours, and then the artifacts got wiped. This wasn’t spray and pray. Lumen says sessions involved one to five victims and often focused on a single organization.

The headline, though, is what traveled over that network. Lumen documents four confirmed zero-day campaigns, involving five CVEs, plus one likely one:

Versa Director (SD-WAN orchestrator), CVE-2024-39717
N-able N-central (remote monitoring and management), CVE-2025-8875 and CVE-2025-8876, used as a chain
Cisco Catalyst SD-WAN (controller and manager), CVE-2026-20127
Arista VeloCloud Orchestrator (SD-WAN orchestrator), CVE-2026-16812
Quest KACE (endpoint management), the “likely” one, which Lumen assesses at moderate confidence, with no CVE assigned

Three of the four confirmed campaigns hit SD-WAN platforms. All five CVEs are in CISA’s Known Exploited Vulnerabilities catalog. Lumen says the KACE campaign alone affected more than 30 victims.

Who’s behind it, and how sure are we

Mira, attribution here comes in layers, so let’s be careful.

The Volt Typhoon attribution is Lumen’s. Its evidence is operational: activity Monday to Friday, mostly between 09:00 and 22:00 China Standard Time, multiweek pauses over Chinese New Year, the choice of victims, and continuity with KV-botnet. As of Nov 3, I found no government statement confirming Silent Train or Lumen’s attribution.

The Cisco piece has its own wrinkle. Cisco Talos tracks the group exploiting CVE-2026-20127 as UAT-11473, and assesses with high confidence that its infrastructure “overlaps considerably” with Silent Train. Talos does not call UAT-11473 Volt Typhoon. Overlapping infrastructure isn’t the same as the same people.

You may also see claims that Energy Department facilities were targeted. Those come from anonymous sources in the press, they aren’t in Lumen’s report and no government has confirmed them, so I’m leaving them alone.

Why this matters for critical infrastructure

Let me say the most important thing clearly. Lumen reports no compromise of any OT network, PLC or control system. Every confirmed exploitation was of IT and network management products. Lumen names water, energy, transportation, maritime, rail, aviation and emergency services among the victim sectors, but gives no counts by sector and doesn’t describe access to control systems. Lumen also says it notified hundreds of victims, and that’s a notification count, not a count of networks broken into.

So why am I writing about it here? Because of the targets Volt Typhoon chose.

Lumen puts it like this: “Volt Typhoon directly targets management platforms, which already have visibility, access and administrative functions.” One compromised management platform, Lumen says, gave “admin access to thousands of devices and trusted paths to downstream customers, with no lateral movement.”

Now think about your own setup. The SD-WAN orchestrator builds the paths between headquarters and the plant, the substation, the pump station. The RMM or endpoint management server pushes software and runs commands on engineering workstations and HMIs. Those are management planes, and in a lot of shops nobody files them under OT. In practice, though, they’re OT dependencies.

If an attacker owns the WAN fabric or the agent on your HMI, they may never need to touch your plant firewall. It’s the master key ring again.

And this isn’t just theory about intent. In AA24-038A, CISA, NSA and FBI assessed with high confidence that Volt Typhoon was pre-positioning on IT networks “to enable lateral movement to OT assets to disrupt functions.” That advisory also describes one confirmed compromise where the actors moved laterally to a control system. That was earlier Volt Typhoon activity, not Silent Train, but it tells you where the road leads.

Arista warns that a VeloCloud Orchestrator compromise “may allow attackers access to the VeloCloud Edge devices as well.” CISA says the Cisco SD-WAN exploit lets an attacker add a rogue device that looks like a legitimate SD-WAN component. If your OT traffic rides that WAN, you can’t trust the WAN until it’s checked and rebuilt.

Two more details for the incident responders, familia. Lumen says the actors “erased or altered logs” in several cases. And on KACE, the actor “remained on the KACE server rather than moving laterally.” Why would they move? The server already reached everything.

One last thing before you relax: Lumen says it “quietly disrupted” Silent Train. That isn’t a takedown. Lumen also published no indicators of compromise, so there’s no blocklist to paste in and call it done.

What to do about it

Lumen’s guidance, CISA’s advisories and the vendor fixes all point the same way:

Inventory every management plane with a path into OT. SD-WAN orchestrators, controllers, RMM, endpoint management, out-of-band gear. Know what each one can touch.
Get management interfaces off the internet. Use VPNs, jump hosts or a dedicated management network. Lumen’s 2024 Versa research found initial access through an exposed management port meant for high-availability pairing. Arista says VeloCloud Orchestrator “is exposed by default.”
Patch the control planes first, and check all five CVEs against your versions. For KACE, where there’s no CVE, review server logs and admin activity as far back as you have them.
Ship logs off the box and keep them longer. If the attacker can edit the logs on the device, the device’s logs can’t be your only record.
Watch for admin activity that doesn’t fit your schedule, plus surprise file transfers and new “temporary” managed components. The joint AA26-113A advisory also suggests asking whether you’d expect admin connections from consumer broadband ranges.
Design OT connectivity so a compromised WAN isn’t enough. CISA and NCSC-UK’s Secure Connectivity Principles for OT is a good place to start.

Bottom line

The orchestrator and the RMM server are OT assets now, whether your org chart agrees or not. Protect them like it.
No OT compromise has been reported, but the attacker went after exactly the systems that can reach OT, without lateral movement.
If one of these platforms was exposed and unpatched while these bugs were zero-days, rotate credentials and rebuild from trusted sources. Patching alone isn’t enough.

Stay sharp out there.

Javier