A threat actor whose infrastructure overlaps with a covert network used by China’s Volt Typhoon exploited a critical Cisco SD-WAN vulnerability to deploy malware designed to harvest encryption keys, Cisco Talos reported on Wednesday.
The same day, Lumen’s Black Lotus Labs published research on that network, Silent Train, which Volt Typhoon used to target US organizations, including in a zero-day campaign exploiting the same Cisco flaw.
The vulnerability, CVE-2026-20127, has a CVSS score of 10 and was disclosed in February 2026. Without needing credentials, attackers can exploit it remotely to get past the peering authentication of SD-WAN controller components and obtain admin rights. Cisco warns that this access can be leveraged to alter the SD-WAN network’s configuration.
Attackers planted KeyDrift malware on SD-WAN controllers
Talos attributes the attacks to UAT-11473, which it describes as a highly sophisticated APT targeting space and satellite services, defense and aerospace technology, and policy research. Talos calls the activity historical but has not said when the attacks occurred.
According to Talos, the malware framework, named KeyDrift, was designed to give its operators persistent access to the SD-WAN controllers and to automatically siphon off keying material. It is injected into legitimate control-plane processes, giving it access to control traffic after it has been decrypted.
Its main module, PolyFlame, works as a backdoor and can also relay commands to other hosts as an intermediate command-and-control (C2) node. A second module, LittleFilch, collects keying material that Talos believes includes keys protecting data-plane traffic.
Talos assessed with high confidence that UAT-11473’s infrastructure “overlaps considerably with Volt Typhoon’s ‘Silent Train’ covert access network.” It does not say the two are the same group.
Volt Typhoon used Silent Train in several zero-day campaigns
Black Lotus Labs has monitored Silent Train since late 2023. The network routes the attackers’ traffic through chains of hacked small office routers, IoT devices and enterprise systems that are frequently replaced, and the operators clean up after each session.
Lumen’s monitoring led to hundreds of victim notifications. It also helped uncover at least four confirmed zero-day campaigns targeting Versa Director, N-able N-central, Cisco Catalyst SD-WAN, and VeloCloud Orchestrator, plus a likely zero-day campaign against Quest KACE.
According to Lumen, Volt Typhoon was exploiting CVE-2026-20127 by late 2025 and kept doing so long after Cisco’s disclosure. The group focuses on management platforms and other control-plane systems that offer broad access across an organization.
“Every zero-day campaign through Silent Train targeted this kind of platform,” Lumen noted.
Victims include telecoms firms, government entities, defense contractors, satellite and mission-critical communications providers, MSPs, universities with military ties, and critical infrastructure operators. Hawaii, California and Texas were targeted the most.
Lumen says the victimology points to an attempt to secure footholds in systems that would matter most during a geopolitical crisis, particularly one involving the Indo-Pacific region. However, Black Lotus Labs researcher Mike Horka told journalist Kim Zetter that the hackers have also exfiltrated documents on military operations and network structures, and he believes the activity combines pre-positioning and espionage.
Lumen’s report does not mention KeyDrift or UAT-11473.
Related: Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August
Related: Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
Related: TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices
