conv.

All stories
SecurityQuiet 13d · day 14

Cisco SD-WAN zero-day linked to Volt Typhoon's covert network

Cisco Talos and Lumen researchers connect key-stealing malware and infrastructure overlaps to China-linked APT targeting US critical infrastructure.

newest coverage 13d agosummary written 10d ago3 pieces NewswiresMastodonGoogle News

What to know

  • A Chinese-linked APT group (Volt Typhoon via Silent Train network) exploited a critical Cisco SD-WAN zero-day (CVE-2026-20127, CVSS 10) to deploy KeyDrift malware and harvest encryption keys from network controllers.
  • Cisco Talos linked the attacks to UAT-11473, whose infrastructure overlaps considerably with Volt Typhoon's covert Silent Train network used across at least four confirmed zero-day campaigns.
  • Targets include US telecoms, government, defense contractors, critical infrastructure, and organizations in Hawaii, California, and Texas; Lumen assesses the targeting pattern suggests preparation for geopolitical crisis, especially Indo-Pacific scenarios.
  • Volt Typhoon continued exploiting CVE-2026-20127 long after Cisco's February 2026 disclosure, demonstrating persistent use of the vulnerability against high-value control-plane systems.

“The network routes the attackers' traffic through chains of hacked small office routers, IoT devices and enterprise systems that are frequently replaced, and the operators clean up after each session.”

Lumen Black Lotus Labs · SecurityWeek ↗

Cisco Talos Security researcherLumen Black Lotus Labs Security researcherVolt Typhoon Chinese APTUAT-11473 Sophisticated APT (Talos designation)

Cisco SD-WAN zero-day linked to Volt Typhoon's covert network
securityweek.com

How it unfolded 2 developments, newest first · click a bar or a number to jump articlesposts

Peak 2 pieces in 3h at Oct 29, 4 AM; 3 pieces over 14 days (2 articles · 1 post) Oct 29, 4 AM — 2 pieces · 2 articles — Google News 1, Newswires 1Oct 29, 7 AM — quietOct 29, 10 AM — quietOct 29, 1 PM — 1 piece · 1 post — Mastodon 1Oct 29, 4 PM — quietOct 29, 7 PM — quietOct 29, 10 PM — quietOct 30, 1 AM — quietOct 30, 4 AM — quietOct 30, 7 AM — quietOct 30, 10 AM — quietOct 30, 1 PM — quietOct 30, 4 PM — quietOct 30, 7 PM — quietOct 30, 10 PM — quietOct 31, 1 AM — quietOct 31, 4 AM — quietOct 31, 7 AM — quietOct 31, 10 AM — quietOct 31, 1 PM — quietOct 31, 4 PM — quietOct 31, 7 PM — quietOct 31, 10 PM — quietNov 1, 1 AM — quietNov 1, 3 AM — quietNov 1, 6 AM — quietNov 1, 9 AM — quietNov 1, 12 PM — quietNov 1, 3 PM — quietNov 1, 6 PM — quietNov 1, 9 PM — quietNov 2, 12 AM — quietNov 2, 3 AM — quietNov 2, 6 AM — quietNov 2, 9 AM — quietNov 2, 12 PM — quietNov 2, 3 PM — quietNov 2, 6 PM — quietNov 2, 9 PM — quietNov 3, 12 AM — quietNov 3, 3 AM — quietNov 3, 6 AM — quietNov 3, 9 AM — quietNov 3, 12 PM — quietNov 3, 3 PM — quietNov 3, 6 PM — quietNov 3, 9 PM — quietNov 4, 12 AM — quietNov 4, 3 AM — quietNov 4, 6 AM — quietNov 4, 9 AM — quietNov 4, 12 PM — quietNov 4, 3 PM — quietNov 4, 6 PM — quietNov 4, 9 PM — quietNov 5, 12 AM — quietNov 5, 3 AM — quietNov 5, 6 AM — quietNov 5, 9 AM — quietNov 5, 12 PM — quietNov 5, 3 PM — quietNov 5, 6 PM — quietNov 5, 9 PM — quietNov 6, 12 AM — quietNov 6, 3 AM — quietNov 6, 6 AM — quietNov 6, 9 AM — quietNov 6, 12 PM — quietNov 6, 3 PM — quietNov 6, 6 PM — quietNov 6, 9 PM — quietNov 7, 12 AM — quietNov 7, 3 AM — quietNov 7, 6 AM — quietNov 7, 9 AM — quietNov 7, 12 PM — quietNov 7, 3 PM — quietNov 7, 6 PM — quietNov 7, 9 PM — quietNov 8, 12 AM — quietNov 8, 3 AM — quietNov 8, 6 AM — quietNov 8, 9 AM — quietNov 8, 12 PM — quietNov 8, 3 PM — quietNov 8, 6 PM — quietNov 8, 9 PM — quietNov 9, 12 AM — quietNov 9, 3 AM — quietNov 9, 6 AM — quietNov 9, 9 AM — quietNov 9, 12 PM — quietNov 9, 3 PM — quietNov 9, 6 PM — quietNov 9, 9 PM — quietYesterday, 12 AM — quietYesterday, 3 AM — quietYesterday, 6 AM — quietYesterday, 9 AM — quietYesterday, 12 PM — quietYesterday, 3 PM — quietYesterday, 6 PM — quietYesterday, 9 PM — quietToday, 12 AM — quietToday, 3 AM — quietToday, 6 AM — quietToday, 9 AM — quietToday, 12 PM — quietToday, 3 PM — quietToday, 6 PM — quiet 1–2
Oct 30Oct 31Nov 1Nov 2Nov 3Nov 4Nov 5Nov 6Nov 7Nov 8Nov 9now · 9:14 PM ET
  1. 1

    Lumen details Silent Train victimology and targeting pattern

    Lumen reported that Silent Train victims include telecoms firms, government entities, defense contractors, satellite and mission-critical communications providers, MSPs, universities with military ties, and critical infrastructure operators. Hawaii, California, and Texas were targeted most heavily. Lumen assessed the victimology points to attempts to secure footholds in systems critical during a geopolitical crisis, particularly one involving the Indo-Pacific region.

    “Every zero-day campaign through Silent Train targeted this kind of platform.”
    — Lumen Black Lotus Labs
  2. 2

    Cisco Talos and Lumen publish research linking UAT-11473 to Volt Typhoon's Silent Train

    Cisco Talos reported that UAT-11473, which deployed KeyDrift malware on SD-WAN controllers, has infrastructure that "overlaps considerably" with Volt Typhoon's Silent Train network. On the same day, Lumen's Black Lotus Labs published research detailing Silent Train's use in at least four confirmed zero-day campaigns targeting Versa Director, N-able N-central, Cisco Catalyst SD-WAN, and VeloCloud Orchestrator, plus a likely campaign against Quest KACE.

    “Talos assessed with high confidence that UAT-11473's infrastructure "overlaps considerably with Volt Typhoon's 'Silent Train' covert access network."”
    — Cisco Talos
    1. 1 outlet Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network

      first by SecurityWeek, 13d ago

  3. background

    Cisco discloses CVE-2026-20127 SD-WAN vulnerability — Cisco disclosed a critical SD-WAN vulnerability (CVE-2026-20127) with a CVSS score of 10. The flaw allows remote attackers without credentials to bypass peering authentication of SD-WAN controller components and obtain admin rights, potentially enabling alterations to network configuration.

  4. background

    Volt Typhoon begins exploiting CVE-2026-20127 — According to Lumen, Volt Typhoon was exploiting CVE-2026-20127 by late 2025 and continued doing so long after Cisco's February disclosure. The group deployed KeyDrift malware on SD-WAN controllers to harvest encryption keys.

  5. background

    Lumen Black Lotus Labs begins monitoring Silent Train network — Black Lotus Labs started monitoring Volt Typhoon's covert "Silent Train" network in late 2023. The network routes attackers' traffic through chains of hacked small office routers, IoT devices, and enterprise systems that are frequently replaced, with operators cleaning up after each session.