Search — “CVE-2026-16812”

Black Lotus Labs reports that China-nexus Volt Typhoon has used the Silent Train framework, a rotating chain of compromised SOHO/IoT and enterprise devices, to route and hide operations, with at least four zero-day vulnerabilities exploited against edge and management products. Sources list VeloCloudOrchestrator, Cisco Catalyst SD-WAN, N-able N-central, Versa Director, and Quest KACE (suspected). Hunters should look for chained SSH sessions through relay devices, temporary SSH services and keys created then removed on relays, and unusual administrative activity on centralized management systems.