Talos Links KeyDrift Malware in Cisco SD-WAN to Silent Train Infrastructure
Cisco Talos analyzed the historical exploitation of critical vulnerability CVE-2026-20127 against the Catalyst SD-WAN platform. It says the UAT-11473 actor’s infrastructure significantly overlaps with the Silent Train network, which Lumen attributes to the Volt Typhoon group.
Cisco SD-WAN KeyDrift is the designation for a technical case in which Cisco Talos researchers linked the historical deployment of the KeyDrift malware to Silent Train infrastructure. On October 28, Talos said that the actor tracked as UAT-11473 exploited vulnerability CVE-2026-20127 in Cisco Catalyst SD-WAN components to bypass authentication and deploy a malicious framework.
Talos assesses with a high degree of confidence that UAT-11473’s operational infrastructure significantly overlaps with the covert access network Silent Train. Lumen Black Lotus Labs’ research team attributes this network to the Volt Typhoon group. However, this does not directly confirm that UAT-11473 and Volt Typhoon are the same actors.
Cisco SD-WAN KeyDrift Targets the Control Plane
According to Talos, KeyDrift operates in SD-WAN control-plane processes. It is intended to provide persistent access and obtain sensitive key material. It includes the PolyFlame backdoor and the LittleFilch module, which is designed to collect and exfiltrate keys.
Talos also describes the theft of key material from decrypted control communications. Compromising the control plane can give an attacker privileged access and enable network configuration manipulation. In centralized management and control platforms, such an intrusion can therefore affect a larger portion of an enterprise infrastructure.
Vulnerability CVE-2026-20127 has a CVSS score of 10.0. It affects Cisco Catalyst SD-WAN Controller, Manager and Validator products. Cisco has released security fixes and does not list any alternative solution or workaround for the flaw.
Overlap with Silent Train Is Not Direct Attribution
Lumen Black Lotus Labs says that the Volt Typhoon group was exploiting CVE-2026-20127 as early as late 2025 and continued exploiting it after the flaw was disclosed in February 2026. Lumen describes Silent Train as relay and access infrastructure used in the group’s operations.
Talos’ new analysis provides a technical link between UAT-11473 and this infrastructure, not a definitive identification of the actor as Volt Typhoon. Lumen’s attribution of Silent Train likewise represents an assessment by the company’s research team, not a public attribution decision by a government authority.
Talos also does not report a new ongoing campaign against additional victims. It is a published technical analysis of historical activity and its connection to an already known network.
Fixes and Compromise Assessment
Operators of affected Cisco Catalyst SD-WAN components should prioritize deploying the available fixes, as the vendor does not list an alternative risk mitigation. Organizations should also check for indicators of compromise and conduct a forensic review of their environments, particularly control-plane systems.
Further developments may come from Cisco, CISA or other authorities in the form of new indicators of compromise, information about the extent of exploitation or additional victims. It will also be important whether Talos or Lumen publish evidence that more precisely confirms or refutes the relationship between UAT-11473 and Volt Typhoon.
Sources
- Cisco Talos – Talos describes CVE-2026-20127 exploitation by UAT-11473, the KeyDrift framework and its high-confidence assessment of infrastructure overlap with Silent Train.
- Cisco Security Advisory – Confirms the severity of CVE-2026-20127, the affected components, the availability of fixes and the absence of a workaround.
- Lumen Black Lotus Labs – Lumen attributes Silent Train to Volt Typhoon, describes its relay architecture and reports the use of CVE-2026-20127 since late 2025.
- SecurityWeek – Independently summarizes the new connection between Talos’ and Lumen’s findings and notes that infrastructure overlap is not a direct identification of the actors.
Verified and updated: October 29, 2026 15:26
