Silent Train linked to Cisco SD-WAN key theft and four zero-days
October 29: Later reports name fixed SD-WAN releases, say Talos saw CVE-2026-20182 exploited, and BleepingComputer says UAT-8616 used CVE-2026-20127 as a zero-day since at least 2023.
Lumen ties Volt Typhoon’s Silent Train to four zero-days; Cisco says related SD-WAN key theft was limited and is patched.
Lumen’s Black Lotus Labs says China-linked Volt Typhoon has used Silent Train, a rotating relay of compromised SOHO, IoT, and enterprise devices, since late 2023 against U.S. government, defense, telecom, and infrastructure targets. Confirmed zero-days are Versa Director CVE-2024-39717, N-able N-central CVE-2025-8875 and CVE-2025-8876, Cisco Catalyst SD-WAN CVE-2026-20127, and VeloCloud CVE-2026-16812. Cisco Talos says UAT-11473 exploited the CVSS 10 Cisco flaw to install KeyDrift and collect suspected AES-256 keying material. Cisco calls that exploitation limited, with February 2026 fixes and no workaround. Talos rates Silent Train overlap as high confidence but does not equate UAT-11473 with Volt Typhoon, while Lumen attributes the network to the group and says exploitation continued after disclosure. Quest KACE remains moderate confidence.
- Fixed SD-WAN trains named include 20.9.8.2, 20.12.6.1, 20.15.4.2, and 20.18.2.1.
- PolyFlame injects into vdaemon; LittleFilch hooks SSL_read for key material.
- Chains spanned more than 27 device classes and as many as six hops.
- Quest KACE affected more than 30 victims; the zero-day link is moderate confidence.
- One report says Talos also saw exploitation of vdaemon flaw CVE-2026-20182.
Timeline
dated events in the reporting · oldest first- Oct 28, 2026Talos and Lumen publish KeyDrift and Silent Train findings · The Hacker News
What each outlet adds
beyond the shared facts- Cisco TalosDetails KeyDrift components and high-confidence Silent Train overlap.
- SecurityWeekTalos does not equate UAT-11473 with Volt Typhoon.
- Cyber Security NewsNames fixed releases and says CVE-2026-20182 was exploited.
- BleepingComputerSays UAT-8616 exploited the Cisco flaw since at least 2023.
- Security AffairsSessions averaged about four hours; Quest confidence is moderate.
- Products
- Cisco Catalyst SD-WANCatalyst SD-WAN ControllerCatalyst SD-WAN ManagerCatalyst SD-WAN ValidatorVersa DirectorN-centralVeloCloud OrchestratorQuest KACECisco SD-WAN Catalyst ControllerN-able N-centralNetgear OrbiCisco Catalyst SD-WAN Controller
- Threat actors
- Volt TyphoonUAT-11473UAT-8616
- Malware
- KeyDriftPolyFlameLittleFilchrsshdconf_sshdaaamgrdKV-BotnetSilent TrainChiselFRPVersaMemKV Botnet
- Organizations
- Cisco TalosBlack Lotus LabsLumenCISAFBINCSCLumen Black Lotus LabsNSALumen TechnologiesJustice Department
- Countries
- United StatesChina
Coverage
oldest first · one row per article · UTC- · 2d ago
CyberScoopFirst report
Volt Typhoon rebuilt Silent Train relay chains since late 2023
Black Lotus Labs says chains were rebuilt in under two minutes and hundreds of victims were notified.
- · 2d ago
BleepingComputer
Volt Typhoon uses Silent Train relays for zero-day edge attacks
Black Lotus Labs says four confirmed zero-days hit VeloCloud, Cisco SD-WAN, N-central, and Versa Director.
- · 2d ago
The Hacker News
Volt Typhoon used Silent Train in four zero-day campaigns
Black Lotus Labs says the rotating SOHO and IoT relay network hit hundreds of victims, including US critical infrastructure.
- · 1d ago
Cisco Talos
UAT-11473 used Cisco SD-WAN auth bypass to plant KeyDrift
Talos says the implant lives in controller processes, steals data-plane keys, and overlaps Volt Typhoon infrastructure.
- · 1d ago
Cisco SD-WAN CVE-2026-20127 exploited to install KeyDrift key-stealing malware
The malware hooks vdaemon to copy AES-256 key material; Cisco calls exploitation limited and lists fixed trains.
- · 1d ago
GBHackers
Volt Typhoon Exploits Zero-Days to Breach Critical Infrastructure
Volt Typhoon built Silent Train framework using zero-days in Quest KACE, N-central, Cisco SD-WAN and VeloCloud to access U.S. critical infrastructure.
- · 1d ago
SecurityWeek
Volt Typhoon-linked actor exploited Cisco SD-WAN zero-day to steal encryption keys
CVE-2026-20127 (CVSS 10) gives unauthenticated admin access to SD-WAN controllers; KeyDrift malware siphoned keying material and Volt Typhoon kept exploiting the flaw after disclosure.
- · 1d ago
Security Affairs
Volt Typhoon used Silent Train relays to hide zero-day attacks
Lumen links the relay network to four confirmed zero-days and one likely flaw, with sessions rebuilt in under two minutes.
- · 1d ago
Cyber Security News
Volt Typhoon used Silent Train for US zero-day intrusions
Lumen says four confirmed zero-day campaigns hit management platforms, with credential theft and chains of compromised devices.
- · 1d ago
KeyDrift malware steals SD-WAN encryption keys via CVE-2026-20127
UAT-11473 uses a CVSS 10.0 auth bypass on Cisco Catalyst SD-WAN to plant in-process key stealers; fixes exist but no workaround.
- · 1d ago
Cisco SD-WAN zero-day CVE-2026-20127 used to install KeyDrift
Talos says UAT-11473 stole suspected IPsec keys from space, defense, and policy targets; patches shipped in February 2026.
- · 1d ago
Help Net Security
Volt Typhoon used rotating Silent Train relays for zero-days
Lumen says exploited products included Versa, N-able, Cisco SD-WAN, VeloCloud and possibly Quest KACE; KeyDrift hit Cisco controllers.
- · 1d ago
Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware
CVE-2026-20127, patched in February 2026, lets attackers add rogue peers and steal IPsec key material from controllers.
- · 20h ago
CSO Online
Lumen says Volt Typhoon banks Silent Train access in infrastructure
Lumen says the group rotates exploited SOHO, IoT and enterprise devices, including multiple zero-days, against high-value targets.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-39717 | Unrestricted File Upload in Versa Networks Versa Director Exploited by Volt Typhoon | 7.2 | 4% | KEV | KEV |
CVE-2025-8876+1 related CVE | OS Command Injection in N-able N-central Before 2025.3.1 | 9.4 | 4% | KEV | KEV |
| CVE-2026-16812 | OS Command Injection in Arista VeloCloud Orchestrator On-Prem | 10.0 | 2% | KEV | KEV |
| CVE-2026-20127 | Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator | 10.0 | 89% | KEV | KEV |
| CVE-2026-20182 | Authentication Bypass in Cisco Catalyst SD-WAN Control Components | 10.0 | 92% | KEV | KEV |