Cisco SD-WAN Zero-Day Exploited by Volt Typhoon for Key Theft

Cisco Talos has reported that a threat actor linked to China, known as 'Volt Typhoon,' exploited a critical zero-day vulnerability in Cisco SD-WAN devices to distribute malware. This vulnerability, identified as CVE-2026-20127, allowed attackers to gain administrative access to network controllers without requiring authentication.

Why it matters

This vulnerability is significant because it grants unauthorized access to the controllers that manage network operations. Attackers could leverage this access to modify network configurations and, crucially, to install custom malware named 'KeyDrift,' specifically designed to steal the encryption keys used to secure communications between network sites. The compromise of these keys could completely jeopardize the confidentiality of network traffic. While Cisco Talos has described these attacks as 'historical,' they have not provided specific details on when the attacks occurred or the extent to which keys were exfiltrated.

What it means for you

Cisco SD-WAN solutions are utilized in the network infrastructure of numerous large corporations, telecommunication providers, and public institutions globally. Consequently, the exploitation of this vulnerability poses a substantial risk to such organizations. Although the vulnerability was patched in February 2026, systems that have not yet applied the updates may remain vulnerable. It is crucial for organizations to apply the patches released by Cisco as soon as possible and to review their network security posture. Additionally, adherence to Cisco's recommended SD-WAN security configuration guidelines is advised. Further steps may be necessary to remove any malware that attackers may have already installed on compromised devices.

Volt Typhoon and the Silent Train Network

Cisco Talos identified that the infrastructure used by the attackers significantly overlaps with Volt Typhoon's covert access network, dubbed 'Silent Train.' This network, detailed by Lumen's Black Lotus Labs, routes attacker traffic through a series of compromised small office routers, IoT devices, and enterprise systems. Volt Typhoon is known to have used this network for zero-day campaigns targeting sensitive entities, including telecommunication firms, government agencies, defense contractors, and critical infrastructure operators, particularly in the United States. The architecture of this network aids attackers in obscuring their tracks and evading detection.

KeyDrift Malware

The KeyDrift malware employed by the attackers is engineered to provide persistent access to SD-WAN controllers and to automatically harvest keying material. The software is injected into legitimate control-plane processes, granting it access to decrypted control traffic. Its primary module, PolyFlame, functions as a backdoor capable of relaying commands. A secondary module, LittleFilch, collects information believed to include keys protecting data-plane traffic. This collected data is thought to be stored for later use.