> TritonInfoSec News
Home / Oct 30, 2026 / Story
0
#3 SecurityWeek general October 29, 2026 at 10:29 UTC

Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network

By Eduard Kovacs

AI Summary

Cisco Talos linked the exploitation of a Cisco SD-WAN zero-day and deployment of the KeyDrift malware — designed to exfiltrate SD-WAN encryption keys — to infrastructure overlapping with Volt Typhoon's 'Silent Train' network, a covert ephemeral proxy framework documented by Lumen. The malware targets Cisco Catalyst SD-WAN Controllers and stores stolen keys for later decryption of inter-site traffic. This attribution connects the campaign to Chinese state-sponsored critical infrastructure targeting operations.

Read full article → https://www.securityweek.com/cisco-sd-wan-zero-day…

Relevance score: 89.0/100

# More from October 30

  1. 1
    Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen The Hacker News
  2. 2
    New Cisco firewall zero-day exploited to crash SSL VPN devices BleepingComputer
  3. 4
    Volt Typhoon hides zero-day attacks using 'Silent Train' framework BleepingComputer
  4. 5
    Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces The Hacker News
  5. 6
    China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility The Hacker News
  6. 7
    Chrome extensions with 13.4 million installs caught hijacking searches BleepingComputer
  7. 8
    Massive leak exposes 41,000 DHS workers and undercover ICE agents Ars Technica Security
  8. 9
    Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls The Hacker News
  9. 10
    Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys The Hacker News