CERT24Cisco SD-WAN zero-day exploitation linked to Volt Typhoon’s “Silent Train” networkLoading data…
CERT24Threat Observatory
Period

Cisco SD-WAN zero-day exploitation linked to Volt Typhoon’s “Silent Train” network

Cisco Talos reported that UAT-11473 exploited the critical Cisco SD-WAN vulnerability CVE-2026-20127 to deploy malware designed to collect keying material on SD-WAN controllers. UAT-11473 infrastructure overlapped considerably with Volt Typhoon’s covert “Silent Train” network, but Talos did not say that the two are the same group.

← Back to intelligence

Cisco SD-WAN zero-day exploitation linked to Volt Typhoon’s “Silent Train” network

Cisco Talos reported that UAT-11473 exploited the critical Cisco SD-WAN vulnerability CVE-2026-20127 to deploy malware designed to collect keying material on SD-WAN controllers. UAT-11473 infrastructure overlapped considerably with Volt Typhoon’s covert “Silent Train” network, but Talos did not say that the two are the same group.