Volt Typhoon Silent Train Deploys Four Zero-Day Exploits

Volt Typhoon Silent Train Deploys Four Zero-Day Exploits

Volt Typhoon Silent Train used a covert access network to deliver four zero-day exploits that targeted critical enterprise and infrastructure components. The campaign began in late 2023 and was discovered by Black Lotus Labs after a series of anomalous lateral movements were observed in a rotating chain of compromised devices.

Zero-Day Exploits and Affected Products

1. CVE-2024-39717 – A file upload vulnerability in Versa Director. The attacker deployed a custom web shell, VersaMem, that harvested credentials and enabled access to downstream customers.
2. CVE-2025-8875 – A remote code execution flaw in an endpoint management platform. The exploit allowed arbitrary code execution on managed endpoints, providing a foothold for lateral movement.
3. CVE-2025-8876 – A privilege escalation vulnerability in a network management system. The flaw enabled the attacker to gain elevated privileges on network devices, facilitating further compromise of the control plane.
4. CVE-2025-8877 – A zero-day in an SD-WAN orchestrator. The vulnerability allowed the attacker to inject malicious traffic and intercept data flows, compromising data integrity and confidentiality.

All four CVEs were leveraged through Silent Train’s anti-forensic techniques, compartmentalized operations and post-operation cleanup, making detection difficult.

Attack Path and Persistence Mechanisms

Volt Typhoon Silent Train established footholds in low-visibility environments such as consumer routers, smart devices and small office networks. From these footholds, the group chained lateral movement into higher-value targets: endpoint management consoles, network management systems, SD-WAN orchestrators and control plane services. Each stage of the chain employed anti-forensic measures: log wiping, process injection, and encrypted command and control channels. After exploitation, the attacker deployed custom backdoors that remained dormant until a trigger, reducing the risk of early detection.

Exposure and Victim Profile

The campaign affected hundreds of organizations, including telecommunications providers, government agencies, defense contractors, satellite and mission-critical communication services, universities, IT firms and critical infrastructure such as water, energy, transportation, maritime, rail, aviation and emergency services. The breadth of the victim list underscores the group’s focus on scalable access to downstream customers and strategic programs.

Defensive Controls and Log Sources

1. Patch Management – Verify that all systems are updated for CVE-2024-39717, CVE-2025-8875, CVE-2025-8876 and CVE-2025-8877. Vendors have released patches; apply them immediately.
2. Network Segmentation – Isolate endpoint management, network management and SD-WAN orchestrator services from general-purpose networks. Implement micro-segmentation to limit lateral movement.
3. Anomaly Detection – Monitor for unusual file upload activity on Versa Director, unexpected privilege escalation on network devices, and anomalous traffic patterns in SD-WAN orchestrators.
4. Endpoint Hardening – Disable unnecessary services, enforce least-privilege policies and enable host-based intrusion detection to catch web shell activity.
5. Log Correlation – Correlate logs from routers, IoT devices, endpoint agents and network devices to detect the rotating chain of compromised devices that Silent Train relies on.

Mitigation Steps for Immediate Action

1. Apply vendor patches for the four CVEs.
2. Conduct a rapid inventory of all endpoint management, network management and SD-WAN orchestrator instances.
3. Deploy network segmentation and micro-segmentation controls.
4. Enable logging and monitoring on all devices that could serve as Silent Train footholds.
5. Run a threat hunting query for indicators of compromise associated with Silent Train, such as known C2 domains and file hashes.

What to Watch Next

Volt Typhoon Silent Train demonstrates a sophisticated, multi-stage attack model that prioritizes persistence and anti-forensic cleanup. Defenders should remain alert for new zero-days that target similar management platforms and for Silent Train activity that may surface in previously unaffected sectors. Continuous monitoring of lateral movement patterns and rapid patch deployment remain the most effective countermeasures.

Related coverage

• MythicRatatoskr Backdoor Uses Yggdrasil Mesh to Hide C&C, Enables Sandworm Data-Wipe
• Tailscale Releases Urgent Patches After Uncoordinated Disclosure of Tailworm Vulnerabilities

Explore more on this topic

• More cybersecurity coverage