The Tools That Run Your Network Are the Tools That Compromised It

On October 28, security researchers at Black Lotus Labs, the threat intelligence arm of Lumen Technologies, published findings that should worry every executive who signs off on IT budgets. A Chinese state-sponsored hacking group known as Volt Typhoon has been quietly exploiting the very platforms that companies use to manage their networks, and it has been doing it with previously unknown vulnerabilities that gave defenders no warning.

The targets were not email servers or customer databases. They were the tools your IT team uses to push patches, configure firewalls, and monitor every device in your organization: Versa Director, N-able N-central, Cisco Catalyst SD-WAN Manager, and Arista VeloCloud Orchestrator. These are the control plane of the modern enterprise. Compromise one, and you do not need to break into individual machines. You already have the keys to all of them.

What Black Lotus Labs Found

Lumen’s researchers documented a covert relay infrastructure they call “Silent Train.” It works like this: Volt Typhoon chains together compromised home routers, IoT devices, and enterprise equipment into temporary tunnels that route attack traffic through dozens of innocent-looking devices before reaching the target. Each chain is assembled in under two minutes and typically lasts about four hours before the group tears it down and removes its traces. The infrastructure first appeared in late 2023 and expanded significantly after the FBI disrupted the group’s earlier relay network, known as KV-botnet, in early 2024.

Through Silent Train, the researchers tied Volt Typhoon to four confirmed zero-day campaigns, each targeting a different enterprise management platform:

• Versa Director, a network orchestration tool used by service providers and large enterprises (CVE-2024-39717)
• N-able N-central, a remote monitoring and management platform relied on by managed service providers and IT departments (CVE-2025-8875 and CVE-2025-8876)
• Cisco Catalyst SD-WAN Manager, which controls software-defined wide-area networking for distributed organizations (CVE-2026-20127)
• Arista VeloCloud Orchestrator, an SD-WAN management console (CVE-2026-16812, rated 10.0 out of 10 on the industry severity scale)

A fifth campaign targeting Quest KACE, an endpoint management tool, reportedly affected more than 30 organizations, though researchers assessed that one with only moderate confidence.

Why This Matters to Boards and Executives

The pattern is deliberate. Volt Typhoon is not chasing credit card numbers or email archives. U.S. intelligence agencies have assessed that the group’s mission is pre-positioning: establishing persistent, hidden access inside American critical infrastructure so that China could disrupt essential services during a future geopolitical crisis. The sectors in the crosshairs include telecommunications, energy, water utilities, transportation, and defense contractors.

What makes this campaign different from a typical breach is the choice of target. Enterprise management tools sit at what security professionals call the “control plane.” An attacker who compromises your SD-WAN orchestrator does not just see your network traffic. They can reroute it. An attacker inside your remote monitoring platform does not just read your patch schedule. They can push code to every machine you manage. These tools exist specifically because they have broad, privileged access. That is what makes them powerful for your IT team and devastating in the hands of an adversary.

For boards, this should prompt an uncomfortable question: do you know which management platforms your organization depends on, and when those platforms were last assessed for security? In my experience working with executive teams, most boards can name their cloud provider and their endpoint protection vendor. Almost none can name their SD-WAN orchestrator or their remote monitoring tool. Those are “just IT plumbing.” Volt Typhoon is betting on that blind spot.

What to Ask Your CISO This Week

If this story belongs on your next board agenda—and it does—here are the questions that matter:

“Which management platforms have administrative access to our infrastructure, and who audits them?” Every organization has a handful of tools that, if compromised, would give an attacker control over large parts of the environment. Your CISO should be able to name them. If they cannot, that is your answer.

“Are we patched against these specific vulnerabilities?” The CVEs listed above have patches available. But patching enterprise management platforms is not like updating a laptop. These systems often run on dedicated appliances with scheduled maintenance windows. Ask whether the patches have been applied, not just whether they are “in the queue.”

“How would we know if someone was already inside?” Volt Typhoon’s signature is patience. The group uses living-off-the-land techniques, meaning it relies on tools already present on compromised systems rather than installing detectable malware. Traditional antivirus and even many modern detection tools are not designed to flag an administrator using legitimate commands. Ask whether your security team has specifically looked for signs of unauthorized access through management platforms, not just at the network perimeter.

“Do our management tools phone home through infrastructure we do not control?” Silent Train’s relay chains pass through compromised consumer routers and IoT devices. If your management platform communicates through unexpected network paths, that is a signal worth investigating.

The Bigger Picture

This is the third time in two years that U.S. government agencies have issued warnings about Volt Typhoon’s targeting of critical infrastructure. A joint advisory from CISA, the NSA, and the FBI in early 2024 warned that the group had maintained access to some targets for as long as five years. The FBI’s takedown of the KV-botnet in early 2024 was supposed to disrupt the group’s ability to operate. Instead, Black Lotus Labs’ findings suggest that Volt Typhoon rebuilt its infrastructure and escalated to higher-value targets.

The lesson for executives is not about China specifically. It is about what happens when an adversary—any adversary—targets the tools you trust most. The management platforms that make your IT operations efficient are the same platforms that, if compromised, make an attacker’s job efficient. Every board should be asking whether those tools receive the same level of security scrutiny as the crown-jewel data they protect.

In Cyber Risk Is Business Risk, I call this the Three Questions framework: Can it happen to us? What would happen if it did? What are we doing about it? If your organization uses any of the platforms named in this report, the answer to the first question is yes. The answer to the second is that an attacker could gain administrative control over your entire managed infrastructure. The third question is the only one where you still have a say.