Search — “Volt Typhoon”

Cisco Talos reports APT UAT-11473 exploited CVE-2026-20127 (CVSS 10 auth bypass) in Cisco Catalyst SD-WAN controllers and installed the KeyDrift framework, whose infrastructure overlaps with Volt Typhoon's Silent Train network. Trojanized runit scripts remount /rootfs.rw executable and launch conf_sshd, which enumerates vdaemon PIDs and uses the rsshd ptrace injector to load PolyFlame (libdssl.so); a packed aaamgrd variant runs under /etc/sv/aaamgr/. LittleFilch (libcommon.so) hooks SSL_read in vdaemon to steal data-plane keys and stages them in /var/tmp/vdaemon.bin. Hunt for modified /etc/sv/*/run scripts, the listed file artifacts, ELF aaamgrd, and touch/chmod --reference timestomping.

Black Lotus Labs reports that China-nexus Volt Typhoon has used the Silent Train framework, a rotating chain of compromised SOHO/IoT and enterprise devices, to route and hide operations, with at least four zero-day vulnerabilities exploited against edge and management products. Sources list VeloCloudOrchestrator, Cisco Catalyst SD-WAN, N-able N-central, Versa Director, and Quest KACE (suspected). Hunters should look for chained SSH sessions through relay devices, temporary SSH services and keys created then removed on relays, and unusual administrative activity on centralized management systems.