Volt Typhoon “Silent Train” Network Exploits Four Zero-Day Flaws

Security researchers at Lumen Technologies’ Black Lotus Labs have uncovered “Silent Train,” a memory-resident operational relay box (ORB) framework operated by the China-nexus threat group Volt Typhoon across more than 27 device types that can rebuild disrupted command-and-control pathways in under two minutes and has been used to exploit four zero-day vulnerabilities since 2024, while Microsoft reminded enterprise administrators that native SMS and voice multifactor authentication (MFA) in Entra ID will retire on Feb. 1, 2027, and Japan’s GMO Internet Group responded to an intrusion affecting up to 26,739 virtual private servers, according to reports published Oct. 27–28, 2026, by BleepingComputer, CyberScoop, BleepingComputer’s Microsoft Entra report, and BleepingComputer’s GMO report.

Inside Volt Typhoon’s “Silent Train” Relay Framework and Four Zero-Day Exploits

As detailed by BleepingComputer writer Bill Toulas and CyberScoop editor Matt Kapko, Lumen’s Black Lotus Labs tracked Silent Train for more than two years after discovering the framework replaced Volt Typhoon’s KV-botnet following a U.S. government disruption in early 2024. Principal Information Security Engineer Michael Horka said the modular toolkit runs across at least nine processor architectures and more than 27 device classes—primarily end-of-life Soho routers from Actiontec, Asus, Cisco, D-Link, Linksys, Netgear, TP-Link, Zyxel, Axis, DrayTek, and Fortinet, alongside Western Digital NAS devices and ruggedized cellular modems deployed in solar power generation, industrial automation, and emergency services.

Rather than writing files to disk, Silent Train resides entirely in volatile RAM and stores configuration data under "/tmp/run/" using process names such as "udhcpc", "syslog", "crond", or "check_watchdog". The architecture splits compromised devices into First-Impression Nodes (FINs) that handle initial scanning and Core Operational Nodes (CONs) chained up to four hops deep via non-standard high-numbered TCP ports (50000+). When defenders block or reboot a node, the operators reprovision and re-establish a four-hop chain in under two minutes.

Black Lotus Labs observed roughly 800 compromised nodes over the past two years (typically 100 to 300 active at any given time) concentrating reconnaissance against critical infrastructure in California, Texas, and Hawaii—including electric utilities, water districts, municipal governments, energy regulators, aviation, and defense contractors—and linked the network to four zero-day exploits:

• CVE-2026-16812 (Arista VeloCloud Orchestrator): Exploited as a zero-day beginning in early February 2026 against four U.S. targets to deploy a custom Trochilus RAT variant that injected a tiny shell command into "/etc/cron.d/vc_process_check" every five minutes while running its payload inside "/dev/shm" memory.
• CVE-2026-20127 (Cisco Catalyst SD-WAN): Exploited against 22 U.S. targets in data centers, state government, and critical infrastructure starting Feb. 25, 2026, within hours of public disclosure.
• CVE-2025-8875 & CVE-2025-8876 (N-able N-central): Exploited for roughly three weeks before N-able’s Aug. 13, 2025 patch release.
• CVE-2024-39717 (Versa Director): Exploited as a zero-day against U.S. targets in 2024.

Microsoft Sets Feb. 1, 2027 Entra ID Native SMS/Voice MFA Retirement

In enterprise identity security, BleepingComputer editor Sergiu Gatlan reported that Microsoft has issued a three-month reminder urging Entra ID administrators to migrate workforce users to phishing-resistant FIDO2 passkeys (via the Microsoft Authenticator app or hardware security keys) before Feb. 1, 2027.

Starting Feb. 1, 2027, Microsoft will retire native SMS and voice call MFA—along with weak legacy custom-code voice prompts—for workforce tenants, though third-party telephony integrations and Azure Communication Services will remain supported and consumer accounts or External Tenants will not be impacted. Administrators can verify tenant readiness using the Authentication Methods Activity workbook in the Entra admin center.

Japan’s GMO Internet Group Responds to Onamae Desktop Cloud Intrusion

Separately, Japan’s GMO Internet Group warned customers of its Onamae Desktop Cloud virtual private server service to back up data, disconnect from the internet, and power down PCs after detecting an Oct. 20 intrusion that potentially affected 26,739 customer servers and exposed MetaTrader 4 and MetaTrader 5 (MT4/MT5) credentials, according to BleepingComputer. Refusing the attacker’s ¥8 billion ($50 million) ransom demand, GMO partnered with Trend Micro to scan affected systems, confirmed no ransomware payload ultimately triggered on customer PCs despite an online data leak, and announced ¥5,000 ($30) in base inconvenience compensation per customer plus equivalent PC replacements for any hardware damaged by malware.