Cisco Talos chorshanba kuni xabar berishicha, Xitoyning Volt Typhoon guruhi ishlatgan yashirin tarmoq bilan infratuzilmasi bir-biriga mos keladigan tahdid aktori muhim Cisco SD-WAN zaifligidan foydalanib, shifrlash kalitlarini yig‘ish uchun mo‘ljallangan zararli dastur o‘rnatgan.
Shu kuni Lumen’ning Black Lotus Labs Silent Train deb nomlangan ushbu tarmoq haqida tadqiqot e’lon qildi — Volt Typhoon AQSh tashkilotlarini, jumladan, xuddi shu Cisco zaifligidan foydalanib o‘tkazilgan zero-day kampaniyasida nishonga olgan.
CVE-2026-20127 zaifligi CVSS balli 10 ga teng va 2026-yil fevralda e’lon qilingan. Hujumchilar hech qanday ma’lumotlarsiz masofadan turib SD-WAN kontroller komponentlarining peering autentifikatsiyasini chetlab o‘tib, admin huquqlarini qo‘lga kiritishi mumkin. Cisco bu kirish SD-WAN tarmog‘i konfiguratsiyasini o‘zgartirish uchun ishlatilishi mumkinligi haqida ogohlantirgan.
Hujumchilar SD-WAN kontrollerlariga KeyDrift zararli dasturini o‘rnatgan
Talos hujumlarni UAT-11473 deb atagan va uni kosmik va sun’iy yo‘ldosh xizmatlari, mudofaa va aerokosmik texnologiya hamda siyosat tadqiqotlarini nishonga olgan yuqori darajada murakkab APT deb ta’riflagan. Talos bu faoliyatni tarixiy deb atagan, ammo hujumlar qachon sodir bo‘lganini aytmagan.
Talos ma’lumotiga ko‘ra, KeyDrift deb nomlangan zararli dastur tizimi operatorlarga SD-WAN kontrollerlarida doimiy kirish imkonini berish va kalit materialini avtomatik ravishda o‘g‘irlash uchun mo‘ljallangan. U qonuniy boshqaruv tekisligi jarayonlariga kiritiladi va bu unga shifrlangan trafikdan keyin boshqaruv trafikiga kirish imkonini beradi.
Asosiy modul PolyFlame orqa eshik sifatida ishlaydi va boshqa xostlarga oraliq buyruq va nazorat (C2) tuguni sifatida buyruqlarni uzatishi mumkin. Ikkinchi modul LittleFilch Talos ma’lumotiga ko‘ra ma’lumot tekisligi trafikini himoya qiluvchi kalitlarni o‘z ichiga olgan kalit materialini yig‘adi.
Talos yuqori ishonch bilan UAT-11473 infratuzilmasi “Volt Typhoon’ning ‘Silent Train’ yashirin kirish tarmog‘i bilan sezilarli darajada mos keladi” deb baholagan. Ular bir xil guruh ekanligini aytmagan.
Volt Typhoon Silent Train’ni bir nechta zero-day kampaniyalarida ishlatgan
Black Lotus Labs Silent Train’ni 2023-yil oxiridan beri kuzatib kelmoqda. Tarmoq hujumchilarning trafikini tez-tez almashtiriladigan kichik ofis routerlari, IoT qurilmalari va korporativ tizimlar zanjirlari orqali yo‘naltiradi va operatorlar har sessiyadan keyin izlarini tozalaydi.
Lumen kuzatuvi yuzlab jabrlanuvchilarga xabar berishga olib kelgan. Shuningdek, u Versa Director, N-able N-central, Cisco Catalyst SD-WAN va VeloCloud Orchestrator’ga qarshi kamida to‘rtta tasdiqlangan zero-day kampaniyasini, shuningdek Quest KACE’ga qarshi ehtimoliy zero-day kampaniyasini aniqlashga yordam bergan.
Lumen ma’lumotiga ko‘ra, Volt Typhoon 2025-yil oxiriga kelib CVE-2026-20127 dan foydalanishni boshlagan va Cisco e’lon qilganidan keyin ham uzoq vaqt davomida buni davom ettirgan. Guruh tashkilot bo‘ylab keng kirish imkonini beradigan boshqaruv platformalari va boshqa boshqaruv tekisligi tizimlarini nishonga oladi.
“Silent Train orqali har bir zero-day kampaniyasi shu turdagi platformani nishonga olgan,” deb ta’kidlagan Lumen.
Jabrlanuvchilar orasida telekommunikatsiya firmalari, davlat idoralari, mudofaa pudratchilari, sun’iy yo‘ldosh va muhim aloqa provayderlari, MSP’lar, harbiy aloqalari bo‘lgan universitetlar va muhim infratuzilma operatorlari bor. Gavayi, Kaliforniya va Texas eng ko‘p nishonga olingan.
Lumen jabrlanuvchilar profili geosiyosiy inqiroz, ayniqsa Hind-Tinch okeani mintaqasi bilan bog‘liq inqiroz paytida eng muhim bo‘ladigan tizimlarda o‘rnashib olishga urinishni ko‘rsatadi, deb aytadi. Biroq Black Lotus Labs tadqiqotchisi Mayk Horka jurnalist Kim Zetterga xakerlar harbiy operatsiyalar va tarmoq tuzilmalari haqidagi hujjatlarni ham o‘g‘irlaganini aytgan va u bu faoliyat oldindan joylashish va josuslikni birlashtiradi, deb hisoblaydi.
Lumen hisobotida KeyDrift yoki UAT-11473 haqida eslatilmagan.
Bog‘liq: Hujumchilar avgustdan beri ikkinchi Cisco Firewall VPN Zero-Day’dan foydalanmoqda
A threat actor whose infrastructure overlaps with a covert network used by China’s Volt Typhoon exploited a critical Cisco SD-WAN vulnerability to deploy malware designed to harvest encryption keys, Cisco Talos reported on Wednesday.
The same day, Lumen’s Black Lotus Labs published research on that network, Silent Train, which Volt Typhoon used to target US organizations, including in a zero-day campaign exploiting the same Cisco flaw.
The vulnerability, CVE-2026-20127, has a CVSS score of 10 and was disclosed in February 2026. Without needing credentials, attackers can exploit it remotely to get past the peering authentication of SD-WAN controller components and obtain admin rights. Cisco warns that this access can be leveraged to alter the SD-WAN network’s configuration.
Attackers planted KeyDrift malware on SD-WAN controllers
Talos attributes the attacks to UAT-11473, which it describes as a highly sophisticated APT targeting space and satellite services, defense and aerospace technology, and policy research. Talos calls the activity historical but has not said when the attacks occurred.
According to Talos, the malware framework, named KeyDrift, was designed to give its operators persistent access to the SD-WAN controllers and to automatically siphon off keying material. It is injected into legitimate control-plane processes, giving it access to control traffic after it has been decrypted.
Its main module, PolyFlame, works as a backdoor and can also relay commands to other hosts as an intermediate command-and-control (C2) node. A second module, LittleFilch, collects keying material that Talos believes includes keys protecting data-plane traffic.
Talos assessed with high confidence that UAT-11473’s infrastructure “overlaps considerably with Volt Typhoon’s ‘Silent Train’ covert access network.” It does not say the two are the same group.
Volt Typhoon used Silent Train in several zero-day campaigns
Black Lotus Labs has monitored Silent Train since late 2023. The network routes the attackers’ traffic through chains of hacked small office routers, IoT devices and enterprise systems that are frequently replaced, and the operators clean up after each session.
Lumen’s monitoring led to hundreds of victim notifications. It also helped uncover at least four confirmed zero-day campaigns targeting Versa Director, N-able N-central, Cisco Catalyst SD-WAN, and VeloCloud Orchestrator, plus a likely zero-day campaign against Quest KACE.
According to Lumen, Volt Typhoon was exploiting CVE-2026-20127 by late 2025 and kept doing so long after Cisco’s disclosure. The group focuses on management platforms and other control-plane systems that offer broad access across an organization.
“Every zero-day campaign through Silent Train targeted this kind of platform,” Lumen noted.
Victims include telecoms firms, government entities, defense contractors, satellite and mission-critical communications providers, MSPs, universities with military ties, and critical infrastructure operators. Hawaii, California and Texas were targeted the most.
Lumen says the victimology points to an attempt to secure footholds in systems that would matter most during a geopolitical crisis, particularly one involving the Indo-Pacific region. However, Black Lotus Labs researcher Mike Horka told journalist Kim Zetter that the hackers have also exfiltrated documents on military operations and network structures, and he believes the activity combines pre-positioning and espionage.
Lumen’s report does not mention KeyDrift or UAT-11473.
Related: Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August