Assessment at a glance
Identity: a People's Republic of China (PRC) state-sponsored actor named Volt Typhoon by Microsoft and VANGUARD PANDA by CrowdStrike; Secureworks tracks the activity as BRONZE SILHOUETTE. The February 2024 joint advisory also lists Insidious Taurus (Unit 42's name), Dev-0391, UNC3236 and Voltzite. APT number: none assigned by any retained source. Priority exposure: internet-facing network appliances; since 2024, the platforms that administer them (SD-WAN controllers, endpoint-management and remote-monitoring servers); end-of-life small office and home office (SOHO) routers and Internet of Things (IoT) devices conscripted into covert networks; and Active Directory domain controllers once inside. AA24-038A
Current assessment, 1 November 2026 (TIR; high confidence through mid-2026, moderate for the present): the activity continues and its initial access has moved from edge appliances to management planes, on the basis of Lumen's 28 October 2026 report below. The US government's high-confidence assessment that the actor is pre-positioning on IT networks to disrupt operational technology (OT) in a crisis has not been revised by any later government product found in this research. Confidence: high that the techniques below are reported first-hand by the cited investigators; moderate that every publisher's cluster denotes one operator.
Evidence currency: checked on 9 November 2026 against retained public reporting and the primary hosts cited. In-window actor-specific primary evidence: Lumen's Silent Train report (28 October 2026); Talos's KeyDrift report of the same date concerns a separately tracked cluster and is cited for its infrastructure finding; Cisco's advisory for CVE-2026-20127 was revised on 28 October 2026. The most recent government advisory naming the actor in this source set is AA26-113A (23 April 2026); the actor-specific joint advisory retained here is AA24-038A (7 February 2024, mitigations revised 7 March 2024). Everything else dates from 2023 to February 2026.
What changed in the last 90 days
- Silent Train described (28 October 2026). Lumen's Black Lotus Labs reports three years of tracking a covert access framework used by Volt Typhoon since November 2023, hundreds of victim notifications, and four confirmed and one likely zero-day campaigns against management and SD-WAN platforms, detailed below. Lumen, Silent Train
- A separately tracked cluster shares its infrastructure (published 28 October 2026). Talos reports that UAT-11473 exploited CVE-2026-20127 on Cisco SD-WAN controllers and installed the KeyDrift framework, targeting space and satellite services, defence and aerospace technology and policy research, and assesses with high confidence that UAT-11473's operating infrastructure overlaps considerably with Silent Train. Talos titles the analysis historical, gives no intrusion dates and assigns UAT-11473 no nationality or sponsor; the publication date is not an activity date. This profile treats the finding as infrastructure overlap, not common control. TIR's UAT-11473 profile covers the framework itself. Talos, KeyDrift
- The CVE-2026-20127 advisory was revised (28 October 2026). Cisco's advisory reached version 2.1, a revision that only added the link to Talos's KeyDrift post; the substantive changes came earlier (fixed-release table updated 27 February, mitigation guidance 3 March, Catalyst SD-WAN Validator added as affected 16 June). See the CVE section below. Cisco advisory
- Government context. AA26-113A is the most recent joint government product naming Volt Typhoon in the retained source set; the bounded discovery check did not establish a later actor-specific product or a new disruption. AA26-113A
Naming and attribution, by publisher
| Name | Asserted by | What the publisher states | Date basis |
|---|---|---|---|
| Volt Typhoon | Microsoft | State-sponsored actor based in China that typically focuses on espionage and information gathering, active since mid-2021; moderate confidence that this campaign pursues capabilities to disrupt US to Asia communications in future crises. Microsoft | 24 May 2023 |
| VANGUARD PANDA | CrowdStrike | Its name for the actor publicly dubbed Volt Typhoon; China-nexus; related historical activity since at least mid-2020. CrowdStrike | 22 June 2023 |
| BRONZE SILHOUETTE | Secureworks CTU | The activity the May 2023 NSA-led advisory calls Volt Typhoon; US government and defence intrusions since 2021, read as intelligence gain aligned with PRC requirements; likely operates on behalf of the PRC. Secureworks | 24 May 2023 (page metadata) |
| Insidious Taurus | Unit 42 | Carried on AA24-038A's alias list; Unit 42's own assertion was verified but is not cited in this version. AA24-038A | 7 February 2024 |
| Volt Typhoon and six other names | CISA, NSA, FBI and partners | PRC state-sponsored group whose behaviour is not consistent with traditional cyber espionage. AA24-038A | 7 February 2024 |
| UAT-11473 | Cisco Talos | Separate designation for the KeyDrift operator, a sophisticated APT with no stated nationality; infrastructure overlaps considerably with Silent Train. Talos | 28 October 2026 |
| UAT-8616 | Cisco Talos | Separate designation for the cluster that exploited CVE-2026-20127 as a zero-day, with activity back to at least 2023; no stated nationality and no stated link to Volt Typhoon. Talos, UAT-8616 | 25 February 2026 |
UNC3236 (Mandiant) and Voltzite (Dragos) appear only in other publishers' lists; no Mandiant or Dragos page asserting either was found on a permitted host. TIR assessment: use Volt Typhoon or VANGUARD PANDA; treat BRONZE SILHOUETTE as the same activity because Secureworks asserts the mapping itself, and Insidious Taurus as the same activity on the strength of AA24-038A's list; cite each start date with its publisher. Neither UAT-11473 nor UAT-8616 is an alias.
Operations timeline
| When | What is reported | Source |
|---|---|---|
| Since at least mid-2020 | ManageEngine ADSelfService Plus exploits, custom web shells, living off the land (LOTL) | CrowdStrike |
| May 2021 to June 2022 | May 2021: a US network likely compromised, dated by web-shell timestamps when Secureworks responded in June 2022 to the PRTG intrusion there; June 2021: single-factor Citrix entry with a domain administrator account; September 2021: ManageEngine ADSelfService Plus (likely CVE-2021-40539) | Secureworks |
| Mid-2021 to May 2023 | Microsoft's campaign starts mid-2021 and is published 24 May 2023 with the NSA-led joint advisory; Cisco and NETGEAR end-of-life routers implanted with KV Botnet malware support operations before the botnet's late-2023 disruption (the retained sources give no start date) | Microsoft; Secureworks; AA24-038A |
| 2023 | Earliest activity Talos later ties to UAT-8616's exploitation of Cisco Catalyst SD-WAN (a separate cluster) | Talos, UAT-8616 |
| November 2023 to early 2024 | First consistent Silent Train activity, shortly before the initial KV-botnet takedown; Lumen works with US agencies to notify victims and disrupt thousands of routers; the Justice Department's botnet disruption is referenced by AA24-038A | Lumen; AA24-038A |
| 7 February 2024 | AA24-038A reports footholds of at least five years in some victims | AA24-038A |
| Mid-2024 to February 2026 | Versa Director exploitation documented; N-able N-central zero-day chain; Quest KACE campaign of more than 30 victims declines after Quest's October 2025 updates; Cisco Catalyst SD-WAN exploited through CVE-2026-20127 by late 2025, continuing past Cisco's 25 February 2026 disclosure | Lumen; Cisco |
| April to October 2026 | AA26-113A (23 April); Lumen's Silent Train report and Talos's KeyDrift report, and Cisco advisory version 2.1 (28 October) | Joint advisory; Lumen; Talos; Cisco |
Targeting and intent
The joint advisory confirms compromises primarily in the communications, energy, transportation and water and wastewater sectors, in the continental and non-continental United States and its territories including Guam, some at smaller organisations that serve larger ones. It assesses with high confidence that the actor is pre-positioning on IT networks to enable lateral movement to OT assets and disrupt functions, citing minimal activity after credential theft, re-targeting of the same organisations over years, testing of domain-joined OT assets with default vendor credentials, collection of SCADA, relay and switchgear documentation, and one confirmed case in which actors reached a control system and were positioned to reach a second. AA24-038A Lumen's 2023 to 2026 victimology adds telecoms, the defence industrial base, satellite communications, universities, IT firms and managed service providers, and water, energy, transport, maritime, rail, aviation and emergency services, with Hawaii, California and Texas the most targeted regions. Lumen, Silent Train
The publishers disagree on intent, by date. Microsoft (24 May 2023) described an actor that typically focuses on espionage and information gathering, with moderate confidence that this campaign pursues disruptive capability against US to Asia communications; Secureworks (2023) read its 2021 and 2022 cases as intelligence gain aligned with PRC requirements; the authoring agencies (7 February 2024) state the behaviour is not consistent with traditional cyber espionage and assess pre-positioning for disruption with high confidence. Microsoft, Secureworks, AA24-038A TIR note: the later, incident-response-based government assessment is the current one; no retained source reports a disruptive effect having been executed.
Initial access: from edge appliances to management planes
The advisory describes exploitation of known or zero-day vulnerabilities in public-facing routers, VPNs and firewalls from Fortinet, Ivanti Connect Secure, NETGEAR, Citrix and Cisco, then VPN access with stolen credentials; in one confirmed case CVE-2022-42475 was likely exploited on an unpatched FortiGate 300D. AA24-038A From 2024 Lumen's zero-day campaigns all target platforms that administer many other systems; in the KACE case the actor stayed on the management server and used its administrative visibility to obtain credentials without traversing the enterprise, which Lumen notes removes the need for long operating time inside a network. Lumen's telemetry could not always determine whether access used known or undisclosed vulnerabilities. Lumen, Silent Train
| Vulnerability | Exploitation clock, as reported | EUVD | Source |
|---|---|---|---|
| CVE-2021-40539 (ManageEngine ADSelfService Plus) | Likely used in a September 2021 engagement; CrowdStrike's case matched it on tradecraft but lacked the expected log artefacts | Not checked | Secureworks; CrowdStrike |
| CVE-2022-42475 (FortiOS SSL-VPN) | Likely exploited on an unpatched device in one confirmed case; date not given | Not checked | AA24-038A |
| Versa Director | Lumen names no CVE on the retained page and its mid-2024 report was not retained; CVE unverified | Not checked | Lumen |
| CVE-2025-8875, CVE-2025-8876 (N-able N-central) | Chain of previously undisclosed flaws; no dates given | EUVD-2025-24823, EUVD-2025-24822 (checked 1 November 2026; records retained, not linked under the source cap); vendor advisory not retained | Lumen |
| CVE-2026-20127 (Cisco Catalyst SD-WAN) | Zero-day exploitation by UAT-8616 with activity back to at least 2023 (Talos); Volt Typhoon by late 2025 (Lumen); UAT-11473, undated (Talos); disclosed 25 February 2026; exploitation continued | EUVD-2026-8675 | Talos, UAT-8616; Lumen; Talos, KeyDrift; Cisco |
| CVE-2026-16812 (VeloCloud Orchestrator) | Zero-day later assigned the CVE; no dates given | EUVD-2026-49334 (checked 1 November 2026; retained, not linked); vendor advisory not retained | Lumen |
These are exploitation and disclosure clocks, not victim dwell times. Talos, UAT-8616, Cisco advisory, CrowdStrike
CVE-2026-20127: one vulnerability, three clusters
The vulnerability. Cisco advisory cisco-sa-sdwan-rpa-EHchtZk, first published 25 February 2026, describes a peering-authentication flaw in Cisco Catalyst SD-WAN Controller (formerly vSmart) and Manager (vManage), with Validator (vBond) added as affected in version 2.0 on 16 June 2026, exploitable regardless of configuration by an unauthenticated remote attacker to obtain a high-privileged non-root account with NETCONF access; CVSS 10.0, no workarounds, and Cisco PSIRT aware of limited exploitation. Version 2.1 (28 October 2026) only added the link to Talos's KeyDrift post. The fixed-release table and response detail are carried in TIR's UAT-11473 coverage. Cisco advisory EUVD-2026-8675 lists CVE-2026-20127 with the same description, published 25 February 2026 and updated 16 June 2026; its exploitedSince field holds 25 February 2026, the disclosure date, not an exploitation start, and should not be read against Talos's 2023 clock. EUVD-2026-8675
Who exploited it. Three clusters are tied to the CVE and no source merges them or claims exclusivity. Talos reported on 25 February 2026 that it clusters the zero-day exploitation and post-compromise activity as UAT-8616, a highly sophisticated actor, with evidence that the activity went back at least three years to 2023 and partner findings of root escalation through a software downgrade and CVE-2022-20775; Talos gives UAT-8616 no nationality and does not mention Volt Typhoon. Talos, UAT-8616 Lumen reported on 28 October 2026 that Volt Typhoon was exploiting the CVE by late 2025 through Silent Train and continued after disclosure. Lumen, Silent Train Talos reported the same day that UAT-11473 exploited it to deploy KeyDrift, in activity it describes as historical and does not date. Talos, KeyDrift
TIR assessment (moderate confidence): Lumen's late-2025 clock is the earliest Volt Typhoon-attributed exploitation, not the earliest exploitation known; Talos's UAT-8616 evidence reaches back to 2023. Whether UAT-8616, UAT-11473 and Volt Typhoon are one organisation, sub-teams, or distinct users of shared relay infrastructure is not stated by any source; the only published link among them is Talos's infrastructure overlap between UAT-11473 and Silent Train. Treat the CVE as multi-actor and a controller compromise as a control-plane incident first; the Volt Typhoon label is Lumen's attribution for its cases.
Credentials, living off the land and persistence
- Credential theft comes first; persistence is the credentials themselves. LSASS dumping and Ntdsutil-created domain controller installation media (Microsoft); NTDS.dit from a vssadmin shadow copy, exfiltrated with the SYSTEM hive, with offline cracking described as the likely purpose, an outdated comsvcs.dll for MiniDump, and Chrome Login Data taken from an administrator's workstation; the actor primarily relies on valid credentials for persistence and re-dumps them at intervals (joint advisory). Microsoft, AA24-038A
- Web shells and rare malware; discovery that reads like administration. Awen-derived shells, one with AES-encrypted C2, and three other organisations' PRTG servers inside the C2 infrastructure (Secureworks); selfsdp.jspx under ManageEngine's Tomcat, with further shells recoverable from Jasper-compiled class files the clean-up missed, and one access log wiped for the first twelve hours of a day (CrowdStrike); an in-memory JAR web shell on Versa Director (Lumen); custom Impacket and Fast Reverse Proxy (FRP) builds and netsh portproxy in a small number of cases (Microsoft); a PRTG server turned into a proxy, PowerShell queries for Event ID 4624 written to .dat files, and selective log clearing (joint advisory). Secureworks, CrowdStrike, Lumen, Silent Train, Microsoft, AA24-038A
Covert networks: KV-botnet, Silent Train, and who else rides them
KV-botnet and its disruption (active before late 2023). The advisory records that the actor's multi-hop proxies are built from VPS and SOHO routers and that it recently used Cisco and NETGEAR end-of-life routers implanted with KV Botnet malware, referring readers to the Justice Department's release on the botnet's disruption; AA26-113A adds that the KV Botnet was mainly end-of-life Cisco and NetGear routers no longer receiving patches. AA24-038A, AA26-113A Lumen dates the disruption to late 2023, says it worked with US agencies to investigate, notify victims and disrupt thousands of compromised routers, and observed consistent Silent Train activity from November 2023, shortly before the first takedown and increasing after a second disruption. Lumen, Silent Train
Silent Train (November 2023 onward). Lumen distinguishes it from botnets, proxy services and operational relay box networks: operators exploit exposed web interfaces on relay devices, deploy only what chained SSH access needs, work through four to six hops from non-US VPS to a US device, then remove every artefact. Chains were assembled in under two minutes; the text says sessions averaged about four hours while the report's Figure 3 caption says most lasted around eight to ten hours, a conflict Lumen does not reconcile; more than 27 device classes held fixed roles (Intelbras modems only as overseas relays, Netgear Orbi devices as the US hop that touched victims). By early 2025 compromised enterprise platforms, kept one to three months, gave the chains a longer-lived final hop, and reverse tunnels over Chisel and FRP ran alongside SSH chaining. Activity concentrated Monday to Friday, 09:00 to 22:00 China Standard Time. Lumen says it quietly disrupted the framework and that its observations are not a complete census. Lumen, Silent Train
Shared use is the governments' expectation. AA26-113A states that the NCSC believes most China-nexus actors use covert networks, that a single network could be used by multiple actors, that Volt Typhoon used them to pre-position on critical national infrastructure and that Flax Typhoon used a different network for espionage, and relays Mandiant's warning that indicators go extinct quickly on such networks. AA26-113A
TIR assessment (moderate confidence): Silent Train is infrastructure, and the only published tie between UAT-11473 and Volt Typhoon is Talos's high-confidence infrastructure overlap. A defender who finds KeyDrift on a controller has a Cisco SD-WAN control-plane compromise by a sophisticated APT whose infrastructure overlaps a PRC state-sponsored actor's covert network, and should respond on that footing; a connection from a Silent Train relay proves use of the network, not which team used it.
Dwell time: what the sources state
The advisory reports footholds maintained for at least five years in some victim IT environments, without a count; NTDS.dit extracted from three domain controllers across four years at one victim and twice in nine months at another; and nine months of lateral movement to vCenter in one water-sector case. AA24-038A Secureworks' June 2022 engagement dated the likely compromise to May 2021 from web-shell creation timestamps, roughly thirteen months from earliest access to response in that one case; its June 2021 engagement reached ntds.dit about 90 minutes after entry, a speed rather than a dwell. CrowdStrike found its web shell written about six months before the sensor was installed. Secureworks, CrowdStrike Lumen's figures (chains in under two minutes, sessions of hours, enterprise relays kept one to three months) are infrastructure clocks. TIR assessment: quote the five-year figure with its "some victims" scope and the thirteen-month span as one case, not an average; short relay sessions and long footholds are not in tension; record earliest evidenced access, first credential theft, each re-dump and discovery as separate clocks per victim.
TTPs mapped to reported behaviour
Identifiers are those AA24-038A assigns unless marked as TIR inference. UAT-11473's KeyDrift techniques and UAT-8616's post-compromise activity are not mapped here.
| Reported behaviour | ATT&CK | Source |
|---|---|---|
| Exploiting public-facing routers, VPNs and firewalls | T1190 | AA24-038A |
| Multi-hop proxies of VPS and SOHO routers; KV-botnet devices | T1090.003, T1583.003, T1584.005 | AA24-038A |
| Valid credentials as the persistence mechanism; privilege escalation and stored credentials on appliances | T1078, T1068, T1552 | AA24-038A |
| RDP with domain administrator credentials | T1021.001 | AA24-038A |
| Shadow copy for NTDS.dit; likely offline cracking | T1006, T1003.003, T1110.002 | AA24-038A |
| Event-log harvesting; selective log clearing | T1654, T1070.001 | AA24-038A |
| netsh portproxy on a PRTG server | T1112, T1090.001 | AA24-038A |
| UPX-packed FRP; outdated comsvcs.dll staged; zipped collection; SMB exfiltration | T1027.002, T1105, T1560, T1048 | AA24-038A |
| LSASS memory dumping | T1003.001 (inference) | Microsoft |
| Web shells for persistence | T1505.003 (inference) | Secureworks, CrowdStrike |
| Chained SSH through compromised devices; Chisel and FRP reverse tunnels | T1090.003, T1572 (inference) | Lumen |
Detection
All items are illustrative unless tested against the organisation's own telemetry.
Credential theft and proxying on domain controllers and servers. The advisory's Table 1 points to ESENT application-log events showing a database created, attached or detached in a non-standard or temporary directory, vssadmin or ntdsutil invocations, PowerShell Get-EventLog or wevtutil runs filtering Event ID 4624 to .dat files, and the PortProxy registry change on a PRTG server; Microsoft publishes Defender queries for ntdsutil with "create full" and for netsh portproxy v4tov4 launched through WMI, and the detection Behavior:Win32/SuspNtdsUtilUsage.A. Assumptions: logs were not cleared, are forwarded off host, and script block logging is on. False positives: domain controller promotion media, backup software, documented port forwarding and administrators' audit scripts, distinguishable by account, host and output path. AA24-038A, Microsoft
Web shells that survived clean-up. On ManageEngine and other Tomcat applications, compare the JSP files on disk with the Java source and class files the Jasper engine wrote under the work directory, and look for access-log gaps such as a day whose first entries are hours late. False positives: legitimate JSP pages, which have a matching deployed source. CrowdStrike
Covert-network ingress. AA26-113A recommends baselining who connects to VPNs and edge devices, questioning connections from consumer broadband ranges, dynamic feeds rather than static block lists, and NetFlow to find new relay nodes; Lumen recommends centralised logging with extended retention on management, SD-WAN and out-of-band platforms. False positives are staff on home broadband, which is why allow lists and machine certificates are the control for higher-risk organisations. Historical indicators in the 2024 advisory are not reproduced as a current blocklist. AA26-113A, Lumen, Silent Train
Cisco SD-WAN controllers. Cisco's advisory and Talos's February 2026 report both put first weight on manual validation of control-connection peering events, with attention to vManage peer types, and on auth.log entries for vmanage-admin public-key logins from addresses that are not configured system IPs. Snort rules 65938 and 65958 detect exploitation of CVE-2026-20127 by any actor; only the KeyDrift artefact rules, Snort 2 SIDs 67387 to 67416 and Snort 3 7:44 to 7:73, are specific to UAT-11473's tooling, so a hit on the exploitation rules is a control-plane incident whose actor is undetermined. Cisco advisory, Talos, UAT-8616, Talos, KeyDrift
Mitigation and recovery
- Assume full domain compromise once activity is confirmed. Sever or restrict internet connectivity, reset every credential within each compromised account's trust boundary, reset all domain and local accounts including krbtgt twice with replication between, revoke or contain affected access, and audit the running and boot-time configuration of every edge device. AA24-038A
- Remove the entry conditions. Patch or retire internet-facing appliances and plan end of life for unsupported technology, keep no credentials that could yield domain administrator access on edge devices, store no plaintext credentials, require phishing-resistant multi-factor authentication, and change default OT passwords or segment and monitor devices whose passwords cannot change. AA24-038A
- Treat management and control-plane platforms as the perimeter. Restrict administrative interfaces of SD-WAN, endpoint-management and out-of-band platforms to VPNs, jump hosts or management networks, prioritise their patching, review their trust relationships and inventory everything internet-facing. For Cisco Catalyst SD-WAN, upgrade to the first fixed release for the train in use per Cisco's advisory; TIR's UAT-11473 coverage carries the fixed-release table and response steps. Lumen, Silent Train, Cisco advisory
- Harden credential stores and deny the covert networks. Microsoft's controls are the attack surface reduction rules blocking credential theft from lsass.exe and process creation from PsExec and WMI, LSASS protected process light and Credential Guard, and closing or changing compromised accounts; do not expose SOHO management interfaces to the internet. For larger organisations AA26-113A adds IP and geographic allow lists for remote access, machine certificates, zero-trust policies and dynamic covert-network feeds. Microsoft, AA26-113A
Open questions
- How UAT-11473, UAT-8616 and Volt Typhoon relate. Talos ties UAT-11473 to Silent Train by infrastructure overlap only and states no nationality for either cluster; it dates UAT-8616's exploitation as a pre-disclosure zero-day with activity back to at least 2023, but does not date UAT-11473's activity against the 25 February 2026 disclosure; Lumen attributes its cases to Volt Typhoon. Resolution needs a publisher to state victim or tooling overlap beyond the relay chains. Talos, KeyDrift, Talos, UAT-8616, Lumen, Silent Train
- Who else uses the networks, and has anyone evicted the actor. AA26-113A expects shared use and Lumen's Silent Train page does not address exclusivity, so attribution from a relay address alone is unsafe. No retained source reports a victim in which the actor's access was removed and verified absent. AA26-113A, AA24-038A
- Not retained. Vendor advisories for CVE-2025-8875, CVE-2025-8876 and CVE-2026-16812, and Lumen's 2024 Versa Director report, were not retained; the Versa CVE is unverified. The Justice Department's January 2024 KV-botnet release returned no readable content on two URL forms; the disruption is carried here by AA24-038A's reference and Lumen's account. Dragos's February 2026 statement that its VOLTZITE group shares technical overlaps with Volt Typhoon, and that an access broker it calls SYLVANITE hands footholds to VOLTZITE, is on a host outside TIR's retained-source list and is not relied on.
Related TIR coverage
The archived 2023 article Threat Actor Profile: Volt Typhoon records the original Microsoft and CISA reporting, and the APT28 profile discusses covert networks as a shared China-nexus access dependency. TIR's UAT-11473 profile covers the KeyDrift framework and the CVE-2026-20127 response in detail; the two profiles will be cross-linked once both are published.
Sources
- Lumen Black Lotus Labs, Silent Train: uncovering Volt Typhoon's operational framework for zero-day exploitation and strategic access (28 October 2026 per the page's publication metadata; the page shows no visible byline date; consistent with secondary coverage of that day): Original report
- Cisco Talos, Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN (28 October 2026): Original report
- Cisco PSIRT, Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability, cisco-sa-sdwan-rpa-EHchtZk (first published 25 February 2026; version 2.1, 28 October 2026): Original report
- ENISA, EUVD-2026-8675 (CVE-2026-20127; published 25 February 2026, updated 16 June 2026): Original report
- Cisco Talos, Active exploitation of Cisco Catalyst SD-WAN by UAT-8616 (25 February 2026): Original report
- NCSC-UK, CISA, FBI, NSA and partners, AA26-113A, Defending Against China-Nexus Covert Networks of Compromised Devices (23 April 2026): Original report
- CISA, NSA, FBI and partners, AA24-038A, PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (7 February 2024, mitigations updated 7 March 2024): Original report
- CrowdStrike, Falcon Complete MDR Thwarts Novel VANGUARD PANDA (Volt Typhoon) Tradecraft (22 June 2023): Original report
- Secureworks Counter Threat Unit, Chinese Cyberespionage Group BRONZE SILHOUETTE Targets U.S. Government and Defense Organizations (24 May 2023, hosted by Sophos): Original report
- Microsoft Threat Intelligence, Volt Typhoon targets US critical infrastructure with living-off-the-land techniques (24 May 2023): Original report
Version history
Version 1 — 1 November 2026: initial living profile, replacing the archived 2023 article. Built from Lumen's Silent Train report, Talos's KeyDrift and UAT-8616 reports, Cisco's advisory and the EUVD record for CVE-2026-20127, the joint advisories AA24-038A and AA26-113A, and the alias originators' own pages (Microsoft, CrowdStrike, Secureworks). CVE-2026-20127 is recorded as exploited by three separately tracked clusters; the UAT-11473 relationship is recorded as infrastructure overlap, not identity; dwell-time and exploitation clocks are stated with their scope.
Research refreshed on 9 November 2026. Source publication dates and the dates of the underlying activity remain distinct; this is a researched assessment, not a claim of newly observed activity on the publication day.