What happened

• Black Lotus Labs reports that Volt Typhoon used 'Silent Train', a rotating chain of compromised SOHO, IoT and enterprise devices, to route and hide its operations [S1][S2].
• Traffic reportedly starts on VPS infrastructure outside the United States and then passes through hacked devices such as routers, including Intelbras modems and Netgear Orbi devices [S1].
• Operators exploit exposed web interfaces on relay devices and deploy only the tooling needed for chained SSH access, such as temporary SSH services, keys and configuration files [S1].
• At least four zero-days were reported exploited against edge and management products: VeloCloud Orchestrator, Cisco Catalyst SD-WAN, N-able N-central and Versa Director. Quest KACE is suspected [S1][S2].
• Researchers recommend monitoring for unusual administrative activity, restricting internet access to admin interfaces, and centralizing logs with longer retention [S1].

Timeline

Detect

Inbound SSH logins to network or management devices · Device/appliance and Linux auth logs (sshd syslog)

index=* "sshd" ("Accepted publickey" OR "Accepted password") | rex "Accepted \S+ for (?<user>\S+) from (?<src>\S+) port" | stats count min(_time) as first max(_time) as last values(user) as users by host src | where count<5 | sort first

FROM logs-* | WHERE message LIKE "*sshd*" AND (message LIKE "*Accepted publickey*" OR message LIKE "*Accepted password*") | GROK message "Accepted %{NOTSPACE:auth_method} for %{NOTSPACE:ssh_user} from %{NOTSPACE:src} port" | STATS count = COUNT(*), first = MIN(@timestamp), last = MAX(@timestamp), users = VALUES(ssh_user) BY host.name, src | WHERE count < 5 | SORT first

A hit means: A rarely seen source logged in over SSH to a device. This may be one hop in a chained relay; confirm the source against admin jump hosts.

New SSH listener started on an appliance · Device/appliance syslog

index=* ("dropbear" OR "sshd") ("Server listening on" OR "Running in background" OR "Not backgrounding") | stats count min(_time) as first max(_time) as last values(_raw) as msgs by host | sort - last

FROM logs-* | WHERE (message LIKE "*dropbear*" OR message LIKE "*sshd*") AND (message LIKE "*Server listening on*" OR message LIKE "*Running in background*" OR message LIKE "*Not backgrounding*") | STATS count = COUNT(*), first = MIN(@timestamp), last = MAX(@timestamp), msgs = VALUES(message) BY host.name | SORT last DESC

A hit means: An SSH service started on a device. Started outside a change window, or on a non-standard port, this matches the temporary SSH services described [S1].

SSH authorized_keys or SSH config changes · File integrity / device configuration change logs

index=* ("authorized_keys" OR "sshd_config" OR "dropbear") (modified OR created OR deleted OR write) | stats count values(user) as users min(_time) as first max(_time) as last by host | sort - last

FROM logs-* | WHERE (message LIKE "*authorized_keys*" OR message LIKE "*sshd_config*" OR message LIKE "*dropbear*") AND (message LIKE "*modified*" OR message LIKE "*created*" OR message LIKE "*deleted*" OR message LIKE "*write*") | STATS count = COUNT(*), users = VALUES(user.name), first = MIN(@timestamp), last = MAX(@timestamp) BY host.name | SORT last DESC

A hit means: An SSH key or config was written or removed. A create followed by a delete fits the add-then-clean pattern reported for relays [S1].

Admin logins to the named management platforms from unusual sources · Centralized management system logs (SD-WAN orchestrator/manager, RMM)

index=* ("VeloCloud" OR "vManage" OR "Catalyst SD-WAN" OR "N-central" OR "Versa Director" OR "KACE") (login OR logon OR "authentication success") | stats count dc(src) as srcs values(src) as src_list min(_time) as first by host user | sort first

FROM logs-* | WHERE (message LIKE "*VeloCloud*" OR message LIKE "*vManage*" OR message LIKE "*Catalyst SD-WAN*" OR message LIKE "*N-central*" OR message LIKE "*Versa Director*" OR message LIKE "*KACE*") AND (message LIKE "*login*" OR message LIKE "*logon*" OR message LIKE "*authentication success*") | STATS count = COUNT(*), srcs = COUNT_DISTINCT(source.ip), src_list = VALUES(source.ip), first = MIN(@timestamp) BY host.name, user.name | SORT first

A hit means: An admin session on a management system targeted by the reported zero-days. Unknown sources, new accounts or off-hours use warrant review.

Verify

• Match the source IP of each SSH or admin session against approved jump hosts, admin VPN pools and change tickets.
• Check whether the session source is a residential, SOHO or foreign VPS address, which fits the reported relay chain [S1].
• On flagged devices, look for SSH services, keys or config files that the vendor build does not ship [S1].
• Benign look-alikes include vendor support sessions, configuration-management tools pushing keys, firmware upgrades restarting sshd, and SD-WAN orchestrator health checks.

Scope

Affected

• VeloCloud Orchestrator (CVE-2026-16812)
• Cisco Catalyst SD-WAN (CVE-2026-20127)
• N-able N-central (CVE-2025-8875, CVE-2025-8876)
• Versa Director (CVE-2024-39717)
• Quest KACE (suspected, unconfirmed)
• SOHO/IoT devices used as relays, e.g. Intelbras modems and Netgear Orbi [S1]

Only if

• Administrative or management interfaces are exposed to the internet

Not affected if

None stated by the sources.

Enumerate

• Instances and versions of each named product, including SaaS or vendor-hosted tenants
• Which admin and management interfaces are reachable from the internet
• Admin accounts and API keys on those platforms, plus recent changes to them
• SOHO routers and IoT devices at branch and remote-worker sites
• Log retention available for management systems and edge devices

Contain

• Remove internet access to admin interfaces of the named products, or restrict it to allow-listed admin networks [S1].
• Before any rebuild, snapshot configs, logs and file systems of suspect devices; this evidence is lost once a device is reimaged.
• Rotate credentials and API keys for the management platforms. This cannot be undone and will break existing integrations.
• Revoke unknown SSH keys and disable unexpected SSH services on edge devices, after preserving copies.
• Block confirmed relay and source IPs at the perimeter.

Eradicate

• Remove temporary SSH services, keys, configuration files and living-off-the-land tooling found on devices [S1].
• Apply vendor fixes for the listed CVEs once confirmed; fixed versions are not in the sources.
• Reimage or factory-reset compromised SOHO or IoT relay devices, or replace end-of-life ones.

Recover

• Before restoring, validate patched versions, clean configs and the admin account list on each management platform.
• Keep admin interfaces off the internet after recovery [S1].
• Centralize management-system logs with longer retention, and monitor admin activity and SSH logins continuously [S1].

Re-enter the loop when

• Black Lotus Labs or vendors publish IoCs, relay IP lists or the primary report
• A vendor confirms or adds a CVE, including Quest KACE
• Fixed versions or advisories change for any listed product
• Hunts show SSH or admin activity from relay-like sources on additional devices

Debrief

• Record which named products were present and exposed, and when exposure ended.
• Record hunt results and log-retention gaps that limited lookback.
• Gaps in the sources: no IoCs, no exploitation dates, no fixed versions, and no confirmation of which CVEs were zero-days at the time of exploitation.

Detection coverage — checked automatically

Checked automatically 2026-11-10 22:22Z from public sources: 17 published, 28 nothing found, 0 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

Where each CVE comes from: CVE-2025-8875 — Volt Typhoon uses Silent Train relay framework to hide zero-day exploitation against edge and management infrastructure; CVE-2026-16812 — Volt Typhoon uses Silent Train relay framework to hide zero-day exploitation against edge and management infrastructure; CVE-2026-20127 — Volt Typhoon uses Silent Train relay framework to hide zero-day exploitation against edge and management infrastructure. A product row answers "is the software from that story reachable from the internet", not "is this card about that software".

vuln:CVE-2026-16812

vuln:CVE-2026-20127

vuln:CVE-2025-8875

cpe:"cpe:/a:arista:velocloud_orchestrator"

product:"Velocloud Orchestrator"

host.services: (software.product = "Velocloud Orchestrator")

cpe:"cpe:/a:n-able:n-central"

product:"N-central"

host.services: (software.product = "N-central")

cpe:"cpe:/a:cisco:catalyst_sd-wan_manager"

product:"Catalyst Sd-wan Manager"

host.services: (software.product = "Catalyst Sd-wan Manager")

product:"Cisco Catalyst SD-WAN vdaemon"

cpe:"cpe:/a:cisco:sd-wan_vbond_orchestrator"

product:"Sd-wan Vbond Orchestrator"

host.services: (software.product = "Sd-wan Vbond Orchestrator")

Internet-wide count, trend

Shodan's count of matching services on the whole internet, one point a day; the scope (your ranges) is never part of it. A count moves with Shodan's crawl as much as with patching, so read the direction, not the digit.

NVD names 1 more affected product (libraries and embedders); the CVE query covers them where Shodan has fingerprinted the version.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-10 22:22Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• Which four CVEs were the zero-days? CVE-2024-39717 dates from 2024, so the exploitation timeframe is unclear.
• Vendor advisories, fixed versions and confirmation of exploitation per CVE are not in the input.
• Is Quest KACE involvement confirmed, and under which CVE?
• Has Black Lotus Labs published IoCs or the primary report?
• Were financial-sector targets named? The sources given do not say.

Sources

• [S1] https://www.bleepingcomputer.com/news/security/volt-typhoon-hides-zero-day-attacks-using-silent-train-framework/ · BleepingComputer
• [S2] https://thehackernews.com/2026/10/volt-typhoon-used-covert-silent-train.html · The Hacker News

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically; a dismissed draft unpublishes it.