A threat actor linked to China’s Volt Typhoon used a covert network called Silent Train to exploit the critical Cisco SD-WAN vulnerability CVE-2026-20127, which has a CVSS score of 10 and was disclosed in February 2026. The zero-day attack, reported by Cisco Talos, allowed remote, credential-less access to SD-WAN controller components, granting admin rights and enabling the deployment of KeyDrift malware. Talos attributes the campaign to the highly sophisticated APT UAT-11473, which targets space, satellite, defense and aerospace sectors. The malware’s main module, PolyFlame, acts as a backdoor and C2 relay, while LittleFilch harvests keying material from decrypted traffic. Lumen’s Black Lotus Labs says the Silent Train network has been used in multiple zero-day campaigns against platforms such as Versa Director, N-able N-central, Cisco Catalyst SD-WAN and VeloCloud Orchestrator, affecting telecoms, government, defense contractors and critical infrastructure, especially in Hawaii, California and Texas. 1