Cisco SD-WAN Zero-Day Activity Overlaps With Volt Typhoon’s Silent Train Network
Summary
Cisco Talos says UAT-11473 used CVE-2026-20127 to plant KeyDrift on SD-WAN controllers and steal keying material. Talos found infrastructure overlap with Volt Typhoon’s Silent Train network, but does not say the actors are the same.
Key points
- Talos says UAT-11473 exploited CVE-2026-20127, a critical Cisco SD-WAN flaw that permits remote access to controller admin rights without credentials.
- Talos describes the activity as historical but has not specified when the attacks occurred.
- Talos says KeyDrift was designed to maintain controller access and siphon keying material; it is injected into legitimate control-plane processes.
- KeyDrift’s PolyFlame module acts as a backdoor and can relay commands, while LittleFilch collects keying material that Talos believes includes keys protecting data-plane traffic.
- Talos assessed with high confidence that UAT-11473 infrastructure overlaps considerably with Volt Typhoon’s Silent Train network, but did not say the actors are the same.
- Lumen says Volt Typhoon exploited the Cisco flaw by late 2025 and continued after its disclosure; its Silent Train monitoring identified four confirmed zero-day campaigns and one likely campaign.
Article Details
- Event Type
- Zero-day exploitation of Cisco SD-WAN controllers and deployment of key-harvesting malware
- Impact
- The vulnerability allows unauthenticated remote attackers to bypass SD-WAN controller peering authentication and obtain administrator rights, which Cisco says could be used to alter network configuration. Talos reports that UAT-11473 used KeyDrift to maintain access to controllers and collect keying material, including material Talos believes protects data-plane traffic. Separately, Lumen says Volt Typhoon exploited the same flaw in a zero-day campaign; researcher Mike Horka said the hackers also exfiltrated documents about military operations and network structures. Talos assessed that UAT-11473 infrastructure overlapped considerably with Volt Typhoon’s Silent Train network, but did not say the groups were the same.
CVE
People
Threat Actors
UAT-11473Talos attributed historical attacks deploying KeyDrift on SD-WAN controllers to UAT-11473. Talos assessed with high confidence that its infrastructure overlapped considerably with Volt Typhoon’s Silent Train network, but did not say they were the same group.Volt TyphoonLumen reported that Volt Typhoon used the Silent Train network to target US organizations and exploited CVE-2026-20127 by late 2025, continuing after Cisco’s disclosure. Talos separately assessed infrastructure overlap between UAT-11473 and Silent Train without stating that the groups were the same.
Malware
KeyDriftAttackers planted KeyDrift malware on SD-WAN controllersLittleFilchalso relay commands to other hosts as an intermediate command-and-control (C2) node. A second module, LittleFilch, collects keying material that Talos believes includes keys protecting data-plane traffic.PolyFlameIts main module, PolyFlame, works as a backdoor and can also relay commands to other hosts as an intermediate command-and-control (C2) node. A second module, LittleFilch, collects keying material that Talos believes
Vendors
Products
Countries
ChinaA threat actor whose infrastructure overlaps with a covert network used by China’s Volt Typhoon exploited a critical Cisco SD-WAN vulnerability to deploy malware designed to harvest encryption keys, Cisco Talos reportedUnited StatesThe same day, Lumen’s Black Lotus Labs published research on that network, Silent Train, which Volt Typhoon used to target US organizations, including in a zero-day campaign exploiting the same Cisco flaw.
Industries
AerospaceTalos attributes the attacks to UAT-11473, which it describes as a highly sophisticated APT targeting space and satellite services, defense and aerospace technology, and policy research.Critical infrastructureVictims include telecoms firms, government entities, defense contractors, satellite and mission-critical communications providers, MSPs, universities with military ties, and critical infrastructure operators.DefenseTalos attributes the attacks to UAT-11473, which it describes as a highly sophisticated APT targeting space and satellite services, defense and aerospace technology, and policy research.GovernmentVictims include telecoms firms, government entities, defense contractors, satellite and mission-critical communications providers, MSPs, universities with military ties, and critical infrastructure operators.Policy researchTalos attributes the attacks to UAT-11473, which it describes as a highly sophisticated APT targeting space and satellite services, defense and aerospace technology, and policy research.Satellite and mission-critical communicationsVictims include telecoms firms, government entities, defense contractors, satellite and mission-critical communications providers, MSPs, universities with military ties, and critical infrastructure operators.Universities with military tiesVictims include telecoms firms, government entities, defense contractors, satellite and mission-critical communications providers, MSPs, universities with military ties, and critical infrastructure operators.