Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network

Cisco Talos has found a connection between malware that steals SD-WAN keys and infrastructure used by Volt Typhoon's Silent Train network. This network was previously described by Lumen. The malware is related to a zero-day exploitation of Cisco SD-WAN. The connection suggests a link between the key-stealing malware and the Silent Train network. Cisco's security team made this discovery, shedding light on the relationship between the malware and the Volt Typhoon group's infrastructure. The finding indicates that the attackers are using the stolen keys to gain unauthorized access to SD-WAN systems.