Cisco Talos has exposed a significant security breach involving a critical Cisco SD-WAN vulnerability used by a threat actor with ties to China’s Volt Typhoon. This breach was utilized to install malware aimed at harvesting encryption keys, according to a report released on Wednesday.
Details of the Zero-Day Exploit
On the same day, Lumen’s Black Lotus Labs detailed a covert network, named Silent Train, that Volt Typhoon employed to attack U.S. entities. This network was involved in a zero-day campaign exploiting the Cisco flaw identified as CVE-2026-20127. Disclosed in February 2026, this vulnerability has a CVSS score of 10 and allows attackers to bypass SD-WAN controller authentication remotely, granting them administrative privileges. Cisco warns that such access could significantly alter network configurations.
Malware Deployment and Attribution
The attackers used KeyDrift malware on SD-WAN controllers, attributed to a sophisticated APT known as UAT-11473. This group targets industries including space technology, defense, and policy research. The malware framework enables persistent access by injecting itself into control-plane processes, acquiring access to decrypted control traffic.
KeyDrift’s primary module, PolyFlame, functions as a backdoor, while another module, LittleFilch, gathers keying materials. Talos confidently links UAT-11473’s infrastructure with Volt Typhoon’s Silent Train network, though it stops short of declaring them identical.
Implications and Ongoing Monitoring
Black Lotus Labs has been observing Silent Train since late 2023. This network routes through compromised routers, IoT devices, and systems, with operators erasing traces after each session. Their monitoring revealed multiple zero-day campaigns targeting various platforms, including Cisco Catalyst SD-WAN.
Volt Typhoon’s exploitation of CVE-2026-20127 began by late 2025, continuing long after its disclosure. The group targets management platforms that provide extensive organizational access. Lumen’s analysis suggests that the victims, which include telecommunications, government, and defense sectors, indicate a strategic attempt to secure critical footholds, potentially in anticipation of geopolitical tensions in the Indo-Pacific region.
Although Lumen’s findings did not mention KeyDrift or UAT-11473, the implications of this ongoing threat highlight the need for heightened vigilance and improved cybersecurity measures across vulnerable platforms.
