How it works. The operators start on rented servers outside the US, hop through hacked devices such as Intelbras modems overseas and Netgear Orbi routers inside the US, and only then touch the target. Black Lotus Labs says a fresh chain can be rebuilt with different devices in under two minutes, sessions average roughly four hours, and the tooling is deleted afterward. Since early 2025 the group has also kept some hacked company systems as relays for one to three months. Volt Typhoon leaned on this setup after the FBI and Justice Department took down its earlier KV Botnet in early 2024.
What they hit. Researchers saw confirmed zero-day campaigns (attacks on flaws the vendor had not yet fixed) against Cisco Catalyst SD-WAN (CVE-2026-20127), VeloCloud Orchestrator (CVE-2026-16812), N-able N-central (CVE-2025-8875 and CVE-2025-8876) and Versa Director (CVE-2024-39717), plus a suspected zero-day in Quest KACE. They also list compromised gear from Fortinet, Cisco, Ivanti, F5, Check Point, Palo Alto Networks, ManageEngine and ServiceNow across 27+ device types. Black Lotus Labs has notified hundreds of victims in telecom, government, defense, IT services and MSPs, utilities, transportation and aviation. Victim names: Undisclosed.
What I'd do today. The pattern is clear: break the one console that manages everything, and you reach every branch office or customer behind it without noisy hopping around. Take SD-WAN orchestrators, RMM tools like N-central and endpoint managers like KACE off the open internet, put them behind VPN or allow-listed IPs with phishing-resistant MFA, and confirm they are on current patches. Then send their admin logs to your SIEM with long retention, and alert on admin logins from home-broadband IP ranges. Blocking known bad IPs won't help much, since the relays change daily.