# Volt Typhoon Rebuilds Covert Networks

Lumen Technologies’ Black Lotus Labs reports that China-linked Volt Typhoon has used “Silent Train,” a second compromised-device network, during a three-year campaign against U.S. government, defense, telecommunications, university, and critical-infrastructure organizations. The operation uses rapidly rebuilt chains of four to six compromised relays and four zero-day exploits targeting SD-WAN and IT-management platforms. Reported activity includes Energy Department facilities and utilities, with activity concentrated in Hawaii, California, and Texas. The signals identify no specific solicitation, contract, or funding opportunity.

- Agencies, contractors, and managed service providers should review exposure and patch status for VeloCloud Orchestrator, Cisco Catalyst SD-WAN, N-central, Versa Director, and KACE SMA, and verify deployment of the specified fixed builds; the signals do not provide build numbers.
- Procurement teams can use these findings to inform requirements and provider oversight for network visibility, edge-device vulnerability management, zero-day response, and incident response.
- Contractors supporting government or critical-infrastructure networks should review access controls and incident-response plans with their customers and MSPs. The reporting indicates a security need, not a disclosed acquisition action.

**Jurisdictions:** federal, international
**Industries:** Information Technology, Defense & Military
**Topics:** Cybersecurity, Digital Infrastructure
**Published:** October 28, 2026

### Government Entities
- U.S. Department of Energy (DOE)

### Vendors
- Lumen Technologies (Threat-intelligence research publisher)
- Cisco ()
- VeloCloud ()
- N-able ()
- Versa Networks ()

### Key Quotes
> Volt Typhoon demonstrated a repeatable capability to rebuild a new chain with different infrastructure in less than two minutes, making the number of nodes at any one moment effectively close to zero.
> — Michael Horka, Principal Information Security Engineer, Black Lotus Labs

> For each operation the actor builds a fresh chain of four to six hops: two non-US VPSs (Ucloud, Alibaba Cloud and Huawei Cloud appear in examples), then hacked overseas SOHO and IoT gear (Intelbras modems, TP-Link, Ruckus, Zyxel, Cambium), then hacked US devices
> — Original poster

### Sources
- [China’s ‘Volt Typhoon’ quietly built another hacking network following US crackdown, new findings say - Nextgov/FCW](https://www.nextgov.com/cybersecurity/2026/10/chinas-volt-typhoon-quietly-built-another-hacking-network-following-us-crackdown-new-findings-say/416848) - Nextgov/FCW
- [Researchers uncover Volt Typhoon’s covert, ephemeral network | CyberScoop](https://cyberscoop.com/volt-typhoon-silent-train-covert-ephemeral-network-black-lotus-labs) - CyberScoop
- [Researchers uncover Volt Typhoon’s covert, ephemeral network](https://www.reddit.com/r/cybersecurity/comments/1xhsndp/researchers_uncover_volt_typhoons_covert) - reddit-cybersecurity