Cisco Talos Ties SD-WAN Key-Stealing Malware to Volt Typhoon's Silent Train Network

Cisco Talos reported on Wednesday that a threat actor whose infrastructure overlaps with a covert network used by China's Volt Typhoon exploited a critical Cisco SD-WAN vulnerability to deploy malware built to harvest encryption keys. The same day, Lumen's Black Lotus Labs published research on that network, called Silent Train.

The flaw, CVE-2026-20127, carries a CVSS score of 10 and was disclosed in February 2026. Cisco says an unauthenticated remote attacker can get past the peering authentication of SD-WAN controller components and obtain admin rights, which can then be used to alter the network's configuration.

Talos attributes the attacks to UAT-11473, which it describes as a highly sophisticated APT targeting space and satellite services, defense and aerospace technology, and policy research. Talos calls the activity historical but hasn't said when the attacks happened.

The malware framework, KeyDrift, was built to keep persistent access to SD-WAN controllers and automatically siphon keying material. It is injected into legitimate control-plane processes, so it can read control traffic after decryption. Its main module, PolyFlame, acts as a backdoor and can relay commands to other hosts as an intermediate command-and-control node. A second module, LittleFilch, collects keying material that Talos believes includes keys protecting data-plane traffic.

Talos assessed with high confidence that UAT-11473's infrastructure "overlaps considerably with Volt Typhoon's 'Silent Train' covert access network." It does not say the two are the same group.

Black Lotus Labs has tracked Silent Train since late 2023. The network routes attacker traffic through chains of hacked small office routers, IoT devices and enterprise systems that are frequently replaced, and operators clean up after each session. Lumen says its monitoring led to hundreds of victim notifications and helped uncover at least four confirmed zero-day campaigns, against Versa Director, N-able N-central, Cisco Catalyst SD-WAN and VeloCloud Orchestrator, plus a likely one against Quest KACE.

According to Lumen, Volt Typhoon was exploiting CVE-2026-20127 by late 2025 and kept doing so after Cisco's disclosure. Victims include telecoms firms, government entities, defense contractors, satellite and mission-critical communications providers, MSPs, universities with military ties, and critical infrastructure operators, with Hawaii, California and Texas targeted most. Lumen's report does not mention KeyDrift or UAT-11473.

For defenders, the practical takeaway is to treat SD-WAN controllers as high-value control-plane systems: confirm exposure to the flaw Cisco disclosed in February 2026, and watch for unexpected changes to controller configuration or peering settings. Because KeyDrift hides inside legitimate processes, process-level monitoring alone may not surface it.

CVE references

CVE-2026-20127