Cisco Talos on Oct. 28 reported that China-linked threat actor UAT-11473 exploited a maximum-severity authentication bypass flaw in Cisco’s SD-WAN Catalyst Controller.
The Cisco researchers said the threat group installed custom malware Cisco tracks as KeyDrift, which consists of multiple components that aim to collect sensitive keying information, acting as backdoors and command-and-control hosts to steal credentials.
Cisco Talos researchers said the threat actor’s targeting spans across the following vertical sectors: space and satellite services, defense and aerospace technology, and policy research.
Here’s where it gets interesting: Cisco Talos assesses with “high confidence” that UAT-11473’s operating infrastructure overlaps considerably with Volt Typhoon’s Silent Train covert access network — the same network that was used to exploit the Cisco SD-WAN flaw, tracked as CVE-2026-20127, that Lumen’s Black Lotus Labs also reported on Oct. 28.
Heath Renfrow, co-founder and chief information security officer at Fenix24, said he doesn’t believe this is a coincidence and thinks the two research teams are uncovering different parts of a much larger, coordinated threat picture: Cisco Talos has identified a sophisticated actor exploiting a critical SD-WAN vulnerability to establish persistence and harvest encryption keys. On the other hand, Lumen, which has tracked Silent Train since late-2023, has independently documented Volt Typhoon using the Silent Train infrastructure to exploit that same vulnerability and compromise strategically important management platforms.
“The important distinction is that sharing infrastructure does not conclusively establish that these are the same operators,” said Renfrow. “However, when we combine the infrastructure overlap, exploitation of the same vulnerability, targeting patterns, and sophistication of the operations, the connections become difficult to ignore. At a minimum, these findings suggest a closely related operational ecosystem.”
Denis Calderone, prinicpal and CTO at Suzu Labs, summed it up this way: No, this is not a coincidence, but the careful wording was put there for a reason. Lumen's researchers spent three years watching a hidden relay network they call Silent Train, and they attribute that network to Volt Typhoon, the Chinese state-sponsored hacking group. Lumen says Volt Typhoon rode Silent Train into U.S. organizations using the Cisco SD-WAN flaw. Separately, Cisco's own Talos team caught a cluster of activity, which it tracks as UAT-11473, using that same flaw to plant malware that steals the encryption keys protecting SD-WAN traffic. Talos won't say UAT-11473 is Volt Typhoon. What Talos says, with high confidence, is that UAT-11473's command infrastructure overlaps considerably with Silent Train.
"That's threat-intelligence speak for 'same railroad,'" said Calderone. "When two independent research teams surface the same vulnerability, the same victim types in satellite, defense, and telecom, and the same covert network within a day of each other, what you're looking at is two overlapping views of the same activity. What no one can say on the record is that Volt Typhoon itself deployed the key-stealing malware. That's the line the careful wording is protecting, and I get why they are being cautious. Either way, someone was inside the network equipment that carries encrypted traffic for U.S. defense, satellite, and telecom targets, and they were stealing the keys."
Harry Thomas, co-founder and CTO at Frenos, pointed out that while Lumen said Volt Typhoon exploited the Cisco SD-WAN flaw through its Silent Train network, Talos said the infrastructure used by the actor it tracks as UAT-11473 substantially overlaps with that network with high confidence.
“That supports a clear connection, while stopping short of saying Talos has identified UAT-11473 as Volt Typhoon,” said Thomas. “With critical infrastructure operators among the targets, it also helps explain why attackers keep going after management and control systems. Those systems already have privileged access and trusted connections across the environment. Compromising them can give an attacker broad access without having to compromise each device individually.”
In this case, Thomas said Talos described malware designed to maintain access and collect encryption keys from the SD-WAN environment. The broader concern: that attackers could gain a foothold in the systems we rely on to manage and secure our networks.
Jason Soroko, senior fellow at Sectigo, explained that KeyDrift showed why recovering from this attack requires attention to encryption keys: it operates inside the controller and collects material Talos believed included keys protecting traffic between sites. That could let attackers read intercepted traffic protected by those keys without breaking the encryption algorithm, although Talos does not establish that such decryption occurred.
“Changing keys while the malware remains could give attackers the replacements,” warned Soroko. “Therefore, recovery needs to remove the attacker’s access and address exposed keys alongside patching the flaw.”
Bri Frost, director of product management at Cloud Range, said when a critical vulnerability has been widely publicized and a patch has been available since February as it has in this case, leaving systems exposed is a failure of basic security discipline. Frost said tracking vulnerabilities and patching affected assets is part of the job.
“Allowing those gaps to persist makes attackers’ lives easier,” said Frost. “They will always find the lowest hanging fruit and by not patching, you're choosing to be that easy target.”
Frost added that we’re talking about an asset management conversation here: Teams need to know what’s on their network, who owns it, what software it runs, and whether remediation actually happened. An inventory that sits untouched while vulnerabilities pile up delivers zero protection.
“Attackers don’t always need to discover the next zero-day,” said Frost. “Too many organizations leave known vulnerabilities available for exploitation long after a fix exists. Patching can be operationally difficult, but that calls for a managed remediation plan and interim protections — not months of unmanaged exposure."
