Cisco SD-WAN Zero-Day Flaw Linked to Volt Typhoon Network
Security researchers have connected the exploitation of a severe Cisco SD-WAN vulnerability to a covert access infrastructure utilized by the threat actor Volt Typhoon.
Radwan AbdulhadiEditor and technology writer
Cisco SD-WAN Zero-Day Flaw Tied to Covert Operations
A threat actor whose infrastructure overlaps with a covert network operated by China’s Volt Typhoon exploited a critical Cisco SD-WAN vulnerability to deploy specialized key-harvesting malware, according to a report published by Cisco Talos. The disclosure coincided with separate research from Lumen’s Black Lotus Labs detailing the "Silent Train" network, which Volt Typhoon used to target various organizations in the United States, including a campaign leveraging the critical Cisco flaw.
The security defect, tracked as CVE-2026-20127, carries a maximum CVSS score of 10 and was originally disclosed in February 2026. The vulnerability allows unauthenticated remote attackers to bypass peering authentication mechanisms within SD-WAN controller components, granting them administrative privileges. According to Cisco, this unauthorized access can be leveraged to modify the underlying network configurations of affected environments.
KeyDrift Malware Framework Deployed on Controllers
Cisco Talos attributed the attacks to a sophisticated advanced persistent threat (APT) designated as UAT-11473. This group has historically targeted space and satellite services, defense and aerospace technology sectors, and policy research institutions. To maintain long-term access, the operators planted a malware framework named KeyDrift on compromised SD-WAN controllers, engineered to automatically siphon off sensitive keying material.
The KeyDrift framework is injected directly into legitimate control-plane processes, enabling it to intercept control traffic after decryption has occurred. Its primary component, PolyFlame, operates as a backdoor while also serving as an intermediate command-and-control node to relay instructions to other hosts. Additionally, a secondary module called LittleFilch gathers cryptographic material, which researchers believe includes keys protecting underlying data-plane traffic.
The Silent Train Covert Access Network
While Talos did not explicitly declare that UAT-11473 and Volt Typhoon are identical, the security firm assessed with high confidence that the infrastructure of UAT-11473 overlaps significantly with the Silent Train network. Black Lotus Labs has monitored Silent Train since late 2023, observing how the framework routes malicious traffic through frequently replaced chains of compromised small office routers, IoT gadgets, and enterprise systems, with operators clearing logs after each session.
Lumen’s ongoing telemetry and monitoring efforts have triggered hundreds of victim notifications and helped uncover multiple confirmed zero-day campaigns targeting management infrastructure. These campaigns targeted platforms such as Versa Director, N-able N-central, Cisco Catalyst SD-WAN, and VeloCloud Orchestrator, alongside a likely zero-day effort directed at Quest KACE.
Targeting Critical Infrastructure and Strategic Platforms
According to Lumen's analysis, Volt-Typhoon-associated campaigns actively exploited the Cisco vulnerability by late 2025 and continued doing so long after the vendor's official security advisory. The threat actors concentrate heavily on management platforms and control-plane systems that provide expansive organizational access. Lumen noted that every single zero-day campaign deployed via Silent Train focused explicitly on this category of administrative platform.
Identified victims span telecommunications providers, government agencies, defense contractors, satellite and mission-critical communications operators, managed service providers (MSPs), universities connected to military research, and critical infrastructure organizations. Geographically, entities in Hawaii, California, and Texas experienced the highest concentration of targeting. Researchers indicate this victimology suggests an intent to establish durable footholds in critical networks ahead of potential geopolitical crises, particularly in the Indo-Pacific region.
Furthermore, researchers noted that the threat activity involves both strategic pre-positioning and direct espionage. Investigators highlighted that operators have successfully exfiltrated sensitive documentation detailing military operations and underlying network structures, matching insights told to external reporting.
Sources
- SecurityWeekCisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network
Continue chronologically
Related stories
Hackers Exploit Cisco SD-WAN Flaw to Deploy KeyDrift Malware
A newly identified advanced persistent threat group has been observed exploiting a Cisco SD-WAN flaw to deploy a custom malware framework called KeyDrift.
Cisco Patches Actively Exploited SD-WAN Zero-Day Flaw
Cisco has released urgent patches for a critical zero-day authentication bypass vulnerability in Catalyst SD-WAN Manager actively exploited in the wild.
Cisco Warns of New SD-WAN Zero-Day Exploited in Attacks
Cisco has released security updates to address a critical zero-day vulnerability in Catalyst SD-WAN Manager actively exploited by attackers.
Cisco Patches Exploited Firewall Zero-Day Flaw
Cisco has released security fixes for a remotely exploitable zero-day vulnerability in its Secure Firewall ASA and FTD software.