Volt Typhoon Uses Silent Train Relay for Zero-Day Attacks on Cisco SD-WAN
October 29: Merged reports from Lumen and Talos detail Silent Train chains, KeyDrift key theft, and Quest KACE campaign.
Lumen links Silent Train to four confirmed zero-days and one likely flaw; Talos reports KeyDrift key theft on Cisco Catalyst SD-WAN.
China-linked Volt Typhoon used Silent Train, a network of rotated compromised SOHO, IoT, and enterprise devices, to conceal exploitation of zero-days in network management platforms since at least November 2023. Chains averaged four hops and were assembled in under two minutes before cleanup. Confirmed campaigns hit N-central (CVE-2025-8875, CVE-2025-8876), Versa Director, Cisco Catalyst SD-WAN (CVE-2026-20127, CVE-2026-16812), and VeloCloud Orchestrator (CVE-2026-16812). A likely campaign targeted Quest KACE with over 30 victims. UAT-11473 overlapped with Silent Train, deploying KeyDrift to steal AES-256 IPsec keys from defense, space, and policy targets. Cisco released patches for the flaws in February 2026 with no workaround; hundreds of notifications were issued over three years, with hotspots in Hawaii, California, and Texas.
- Silent Train chains used up to six hops across 27 device classes including TP-Link and Netgear Orbi
- Confirmed zero-days: CVE-2025-8875, CVE-2025-8876 (N-central), CVE-2026-20127 (SD-WAN), CVE-2026-16812 (VeloCloud)
- Quest KACE campaign affected >30 victims at moderate confidence; activity mostly weekday China Standard Time
- KeyDrift components PolyFlame and LittleFilch extract session metadata and IPsec keys
- Cisco patches issued February 2026; no workaround for CVE-2026-20127
- Targets include US government, defense contractors, and critical infrastructure
Timeline
dated events in the reporting · oldest first- Oct 28, 2026Lumen reports four confirmed zero-day campaigns via Silent Train · Lumen
- Oct 29, 2026Talos discloses KeyDrift malware deployment on SD-WAN controllers · Talos
What each outlet adds
beyond the shared facts- Lumen Black Lotus LabsSilent Train network details, four confirmed zero-day campaigns, and Quest KACE assessment
- Cisco TalosKeyDrift malware specifics, CVE-2026-20127 exploitation, and target sectors
- Cyber Security NewsTargeting hotspots in Hawaii, California, and Texas
- Help Net SecuritySilent Train device rotation and three-year notification volume
- BleepingComputerKeyDrift command and exfiltration details
- CVEs
- CVE-2026-20127CVE-2026-20182CVE-2024-39717CVE-2025-8875CVE-2025-8876CVE-2026-16812CVE-2026-76418
- Products
- Catalyst SD-WAN ControllerCatalyst SD-WAN ManagerCatalyst SD-WAN ValidatorVersa DirectorN-centralCisco Catalyst SD-WANVeloCloud OrchestratorQuest KACECisco Catalyst SD-WAN ControllerCisco Catalyst SD-WAN ManagerCisco Catalyst SD-WAN ValidatorCatalyst SD-WAN
- Threat actors
- UAT-11473Volt TyphoonUAT-8616
- Countries
- United StatesChina
Coverage
oldest first · one row per article · UTC- · 13d ago
Security AffairsFirst report
Volt Typhoon used Silent Train relays to hide zero-day attacks
Lumen links the relay network to four confirmed zero-days and one likely flaw, with sessions rebuilt in under two minutes.
- · 13d ago
The Hacker News
Cisco patches actively exploited ASA and FTD VPN crash flaw
CVE-2026-76418, scored 8.6, lets unauthenticated attackers reload firewalls when SSL VPN uses secondary authentication.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-39717 | Unrestricted File Upload in Versa Networks Versa Director Exploited by Volt Typhoon | 7.2 | 4% | KEV | KEV |
CVE-2025-8876+1 related CVE | OS Command Injection in N-able N-central Before 2025.3.1 | 9.4 | 4% | KEV | KEV |
| CVE-2026-16812 | OS Command Injection in Arista VeloCloud Orchestrator On-Prem | 10.0 | 2% | KEV | KEV |
| CVE-2026-20127 | Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator | 10.0 | 88% | KEV | KEV |
| CVE-2026-20182 | Authentication Bypass in Cisco Catalyst SD-WAN Control Components | 10.0 | 92% | KEV | KEV |
| CVE-2026-76418 | Unauthenticated DoS in Cisco ASA and FTD SSL VPN with secondary auth | 8.6 | <1% | KEV | KEV |