Cisco SD-WAN Zero-Day Linked to Volt Typhoon

Cisco Talos reported on Wednesday that a threat actor exploiting CVE-2026-20127 deployed KeyDrift malware to harvest encryption keys from SD-WAN controllers. Lumen's Black Lotus Labs published research on the 'Silent Train' network used by China's Volt Typhoon, which targeted US organizations including telecoms and government entities in at least four confirmed zero-day campaigns by late 2025.