# China-Linked 'Volt Typhoon' Exploited 4 Zero-Days

> China's cyberattack group used a stealth relay network to exploit four zero-day vulnerabilities in critical infrastructure systems.
- Title: China-Linked 'Volt Typhoon' Exploited 4 Zero-Days | Shortify
- Summary: China's cyberattack group used a stealth relay network to exploit four zero-day vulnerabilities in critical infrastructure systems. China-linked Volt Typhoon…
- Keywords: volt typhoon, zero-day, lumen technologies, black lotus labs, cisco catalyst sd-wan, versa director, n-central, arista velocloud orchestrator, quest kace, kv-botnet, finance, markets
- Source: BigGo Finance — https://finance.biggo.com/news/73b0a0a2-ea09-45df-92e7-b5ae843eb414
- Author: BigGo Finance
- Published: 2026-10-28T20:55:47+00:00
- Read time: 1 min
- Topics: volt typhoon, zero-day, lumen technologies, black lotus labs, cisco catalyst sd-wan, versa director, n-central, arista velocloud orchestrator, quest kace, kv-botnet, finance, markets
## Silent Train Network
Black Lotus Labs identified a stealth relay network used by China-linked Volt Typhoon group.
## Four Zero-Day Exploits
The group exploited four zero-days in management products including Cisco Catalyst SD-WAN and Versa Director.
## Affected Organizations
Hundreds of organizations across critical infrastructure were impacted, with US victims concentrated in Hawaii, California, and Texas.
## Three-Year Tracking
Black Lotus Labs monitored Silent Train since November 2023, tracking it for three years.
## Product Vulnerabilities
Four products confirmed with zero-days: Versa Director, N-central, Cisco Catalyst SD-WAN, and Arista VeloCloud Orchestrator.
## Relay Network Mechanism
The network used compromised routers and IoT devices to route traffic globally while evading detection.
## Device Usage Patterns
Over 27 device types were used, including SOHO and IoT devices from TP-Link, NETGEAR, and Cisco.
## Short-Lived Operations
Each relay session lasted four hours with traces erased after use to avoid detection.
## Geographic Impact
Hawaii, California, and Texas were especially affected due to military and infrastructure concentration.
## Key takeaway

China-linked Volt Typhoon group exploited four zero-days in management products affecting US critical infrastructure.