By Eduard Kovacs
Publication Date: 2026-10-29 10:29:00
A threat actor whose infrastructure overlaps with a covert network used by China’s Volt Typhoon exploited a critical Cisco SD-WAN vulnerability to deploy malware designed to harvest encryption keys, Cisco Talos reported on Wednesday.
The same day, Lumen’s Black Lotus Labs published research on that network, Silent Train, which Volt Typhoon used to target US organizations, including in a zero-day campaign exploiting the same Cisco flaw.
The vulnerability, CVE-2026-20127, has a CVSS score of 10 and was disclosed in February 2026. Without needing credentials, attackers can exploit it remotely to get past the peering authentication of SD-WAN controller components and obtain admin rights. Cisco warns that this access can be leveraged to alter the SD-WAN network’s configuration.
Attackers planted KeyDrift malware on SD-WAN controllers
Talos attributes the attacks to UAT-11473, which it describes as a highly sophisticated APT targeting space and satellite services,…