Lumen says Volt Typhoon banks Silent Train access in infrastructure
Lumen says the group rotates exploited SOHO, IoT and enterprise devices, including multiple zero-days, against high-value targets.
1
Stories per day · 30 days
1 RSS
Relatedsd-wan9silent-train9zero-day9critical-infrastructure7keydrift7cisco5authentication-bypass3china2encryption-keys2soho2uat-114732attribution1autonomous-cyber-weapons1catalyst-sd-wan1cisco-sd-wan1credential-theft1edge-devices1legislative-oversight1
20 stories, newest first · one card per story
Stories tagged #volt-typhoon
Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware
CVE-2026-20127, patched in February 2026, lets attackers add rogue peers and steal IPsec key material from controllers.
Cisco SD-WAN zero-day CVE-2026-20127 used to install KeyDrift
Talos says UAT-11473 stole suspected IPsec keys from space, defense, and policy targets; patches shipped in February 2026.
KeyDrift malware steals SD-WAN encryption keys via CVE-2026-20127
UAT-11473 uses a CVSS 10.0 auth bypass on Cisco Catalyst SD-WAN to plant in-process key stealers; fixes exist but no workaround.
Volt Typhoon used Silent Train for US zero-day intrusions
Lumen says four confirmed zero-day campaigns hit management platforms, with credential theft and chains of compromised devices.
1
Volt Typhoon used Silent Train relays to hide zero-day attacks
Lumen links the relay network to four confirmed zero-days and one likely flaw, with sessions rebuilt in under two minutes.
Volt Typhoon-linked actor exploited Cisco SD-WAN zero-day to steal encryption keys
CVE-2026-20127 (CVSS 10) gives unauthenticated admin access to SD-WAN controllers; KeyDrift malware siphoned keying material and Volt Typhoon kept exploiting the flaw after disclosure.
30
Volt Typhoon Exploits Zero-Days to Breach Critical Infrastructure
Volt Typhoon built Silent Train framework using zero-days in Quest KACE, N-central, Cisco SD-WAN and VeloCloud to access U.S. critical infrastructure.
1
Cisco SD-WAN CVE-2026-20127 exploited to install KeyDrift key-stealing malware
The malware hooks vdaemon to copy AES-256 key material; Cisco calls exploitation limited and lists fixed trains.
1
UAT-11473 used Cisco SD-WAN auth bypass to plant KeyDrift
Talos says the implant lives in controller processes, steals data-plane keys, and overlaps Volt Typhoon infrastructure.
Volt Typhoon used Silent Train in four zero-day campaigns
Black Lotus Labs says the rotating SOHO and IoT relay network hit hundreds of victims, including US critical infrastructure.
1
Volt Typhoon uses Silent Train relays for zero-day edge attacks
Black Lotus Labs says four confirmed zero-days hit VeloCloud, Cisco SD-WAN, N-central, and Versa Director.
1
Paper proposes 72-hour legislative notice for autonomous cyber weapons
Authors conclude at most one of six oversight bodies could lawfully receive that notice today.
TP-Link Sued by Four More U.S. States Over Router Security and China Ties
Four more U.S. states sued TP-Link over router security claims and alleged China ties.
TP-Link Faces State Lawsuits and New Scrutiny Over ISP Router Flaws
Four US states sue TP-Link over misleading security claims, citing Aginet ISP router flaws enabling unauthenticated full device compromise.
US states sue popular kitmaker TP-Link over China risks
Four US states sued TP-Link, alleging deceptive router-security marketing and hidden reliance on Chinese suppliers.
Hackers Exploit Exposed Industrial Controllers to Disrupt US Water and Critical Infrastructure
Attackers disrupted US water utilities via exposed Rockwell controllers, alongside other industrial-control campaigns.
4
The US needs a real plan to defend its water systems
Op-ed says US water utilities need a federal cybersecurity plan after foreign attacks and rising AI-enabled threats.
5
Srsly Risky Biz: China's Private Sector Botnets Are Worth Disrupting
DoJ seized domains of Chinese espionage botnet platforms QScan and QTRouter, run by private firm QTFY for MSS and PLA targeting.
China Is Strapping ‘Digital Bombs’ to Civilian Infrastructure—Is the US Ready?
WIRED examines Volt Typhoon pre-positioning 'digital bombs' in US civilian infrastructure via a war game simulation discussion.