Lumen says Volt Typhoon banks Silent Train access in infrastructure
Lumen says the group rotates exploited SOHO, IoT and enterprise devices, including multiple zero-days, against high-value targets.
78
Threat actor
Volt Typhoon
- Mentions · 7d15
- Mentions · 30d22
- All mentions30
- First seenAug 19, 2026
- Last mentioned1d ago
Timeline
30 articles · newest firstHackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware
CVE-2026-20127, patched in February 2026, lets attackers add rogue peers and steal IPsec key material from controllers.
84
Volt Typhoon used rotating Silent Train relays for zero-days
Lumen says exploited products included Versa, N-able, Cisco SD-WAN, VeloCloud and possibly Quest KACE; KeyDrift hit Cisco controllers.
86
Cisco SD-WAN zero-day CVE-2026-20127 used to install KeyDrift
Talos says UAT-11473 stole suspected IPsec keys from space, defense, and policy targets; patches shipped in February 2026.
88
KeyDrift malware steals SD-WAN encryption keys via CVE-2026-20127
UAT-11473 uses a CVSS 10.0 auth bypass on Cisco Catalyst SD-WAN to plant in-process key stealers; fixes exist but no workaround.
84
Volt Typhoon used Silent Train for US zero-day intrusions
Lumen says four confirmed zero-day campaigns hit management platforms, with credential theft and chains of compromised devices.
84
Cisco patches actively exploited ASA and FTD VPN crash flaw
CVE-2026-76418, scored 8.6, lets unauthenticated attackers reload firewalls when SSL VPN uses secondary authentication.
82
Volt Typhoon used Silent Train relays to hide zero-day attacks
Lumen links the relay network to four confirmed zero-days and one likely flaw, with sessions rebuilt in under two minutes.
84
Volt Typhoon-linked actor exploited Cisco SD-WAN zero-day to steal encryption keys
CVE-2026-20127 (CVSS 10) gives unauthenticated admin access to SD-WAN controllers; KeyDrift malware siphoned keying material and Volt Typhoon kept exploiting the flaw after disclosure.
92
Volt Typhoon Exploits Zero-Days to Breach Critical Infrastructure
Volt Typhoon built Silent Train framework using zero-days in Quest KACE, N-central, Cisco SD-WAN and VeloCloud to access U.S. critical infrastructure.
80
Cisco SD-WAN CVE-2026-20127 exploited to install KeyDrift key-stealing malware
The malware hooks vdaemon to copy AES-256 key material; Cisco calls exploitation limited and lists fixed trains.
84
UAT-11473 used Cisco SD-WAN auth bypass to plant KeyDrift
Talos says the implant lives in controller processes, steals data-plane keys, and overlaps Volt Typhoon infrastructure.
86
Volt Typhoon used Silent Train in four zero-day campaigns
Black Lotus Labs says the rotating SOHO and IoT relay network hit hundreds of victims, including US critical infrastructure.
84
Volt Typhoon uses Silent Train relays for zero-day edge attacks
Black Lotus Labs says four confirmed zero-days hit VeloCloud, Cisco SD-WAN, N-central, and Versa Director.
86
Volt Typhoon rebuilt Silent Train relay chains since late 2023
Black Lotus Labs says chains were rebuilt in under two minutes and hundreds of victims were notified.
84
Paper proposes 72-hour legislative notice for autonomous cyber weapons
Authors conclude at most one of six oversight bodies could lawfully receive that notice today.
32
TP-Link Sued by Four More U.S. States Over Router Security and China Ties
Four more U.S. states sued TP-Link over router security claims and alleged China ties.
61
TP-Link Faces State Lawsuits and New Scrutiny Over ISP Router Flaws
Four US states sue TP-Link over misleading security claims, citing Aginet ISP router flaws enabling unauthenticated full device compromise.
55
US states sue popular kitmaker TP-Link over China risks
Four US states sued TP-Link, alleging deceptive router-security marketing and hidden reliance on Chinese suppliers.
66
Hackers Exploit Exposed Industrial Controllers to Disrupt US Water and Critical Infrastructure
Attackers disrupted US water utilities via exposed Rockwell controllers, alongside other industrial-control campaigns.
86
OT Attacks on US Critical Infrastructure Could Disrupt Military Operations and Physical Processes
State-linked actors are targeting US critical-infrastructure OT, with confirmed water-system disruption and Volt Typhoon pre-positioning.
81
The US needs a real plan to defend its water systems
Op-ed says US water utilities need a federal cybersecurity plan after foreign attacks and rising AI-enabled threats.
36
Srsly Risky Biz: China's Private Sector Botnets Are Worth Disrupting
DoJ seized domains of Chinese espionage botnet platforms QScan and QTRouter, run by private firm QTFY for MSS and PLA targeting.
76
China's 'Fire Ant' campaign used compromised Cisco routers as platform for more attacks
Sygnia links the China-nexus Fire Ant campaign to UNC3886, showing hackers weaponized compromised Cisco IOS XR routers for espionage and wider intrusions.
70
China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs
China-nexus espionage group Fire Ant compromised Cisco IOS XR routers and TACACS servers to harvest credentials, capture traffic and suppress logs.
78
CISA Warns Water Utilities: Find Your Exposed PLCs Before Attackers Do
CISA urged water utilities to secure internet-exposed PLCs after July 2026 attacks compromised over 100 US water and wastewater systems, suspected Iran-linked.
72
FBI takes down China-linked hacking network behind attacks on NASA, DOJ and U.S. Senate
FBI seized domains disabling QScan and QTRouter malware run by China-linked QTFY group behind intrusions at NASA, DOJ, Senate and other agencies.
80
US takes down alleged Chinese hacking tools used against Federal Reserve, DOJ and Senate
DOJ takes down QScan and QTRouter Chinese obfuscation platforms used to breach Federal Reserve, DOE, DOJ, and Senate since 2018.
76
China Is Strapping ‘Digital Bombs’ to Civilian Infrastructure—Is the US Ready?
WIRED examines Volt Typhoon pre-positioning 'digital bombs' in US civilian infrastructure via a war game simulation discussion.
45
Us Thwarts Volt Typhoon Espionage
US thwarts an espionage operation by Chinese state-linked threat actor Volt Typhoon, according to the headline.
55
Related CVEs
by mentions- CVE-2026-2012789%10.0Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator
- CVE-2026-168122%10.0OS Command Injection in Arista VeloCloud Orchestrator On-Prem
- CVE-2025-88764%9.4OS Command Injection in N-able N-central Before 2025.3.1
- CVE-2025-88753%9.4Insecure Deserialization Code Execution in N-able N-central (KEV)
- CVE-2024-397174%7.2Unrestricted File Upload in Versa Networks Versa Director Exploited by Volt Typhoon
- CVE-2026-2018292%10.0Authentication Bypass in Cisco Catalyst SD-WAN Control Components
- CVE-2026-76418<1%8.6Unauthenticated DoS in Cisco ASA and FTD SSL VPN with secondary auth
- CVE-2023-5022420%6.5Authentication Bypass by Spoofing in TP-Link TL-WR841N Router Exposes Stored Credentials
- CVE-2025-30238<1%8.6In affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to execute higher-privileged operations
- CVE-2025-30240<1%5.1The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices
Appears with
- Ciscovendor · 16
- FBIorganization · 10
- Black Lotus Labsorganization · 10
- Cisco Talosorganization · 8
- KeyDriftmalware · 8
- UAT-11473threat actor · 8
- LittleFilchmalware · 7
- VeloCloud Orchestratorproduct · 7
- PolyFlamemalware · 7
- Lumenorganization · 6
- Flax Typhoonthreat actor · 6
- Versa Directorproduct · 6
- CISAorganization · 5
- N-centralproduct · 5
- Versavendor · 5
- Questvendor · 5
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.