Volt Typhoon
Nation-state Espionage China Active
Aliases: Vanguard Panda · Bronze Silhouette · Voltzite
- Mentions
- 5
- First seen
- 08 Jul 2026
- Last seen
- 29 Oct 2026
Relevant to you · Relevant
- Threat focus:
- espionage / apt
- Sector / region:
- Manufacturing
Origin
China — Chinese state-linked (critical-infrastructure pre-positioning)
Profile
Volt Typhoon is a Chinese threat actor that exploits Cisco SD-WAN zero-day vulnerabilities using the covert, ephemeral 'Silent Train' network. The attacks include four zero-day exploitation campaigns. There are concerns about potential attacks on the US water supply. Researchers have uncovered the actor's covert network.
Affected vendors
VersaQuestCiscoVersa NetworksN-ableArista
Targeted sectors
Water SupplyWater supplyWater and wastewater systemsNetwork infrastructure
Targeted regions
North America
Targeted countries
United States
Associated malware / tools
Silent Train
Activity (8 weeks)
Recent activity
- Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network SecurityWeek
- Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns The Hacker News
- Volt Typhoon hides zero-day attacks using 'Silent Train' framework BleepingComputer
- Researchers uncover Volt Typhoon’s covert, ephemeral network CyberScoop
- What Happens if China Hacks the US Water Supply? I Went to a Secret War Game to Find Out Security Latest