kyber.today

daily cyber × ai intelligence

← threat actors

threat actor · CN

Volt Typhoon

2 stories · 2 in the wild · October 29, 2026 – October 30, 2026

evidence: 2 observed

how they got in

  • edge device 1 · Oct 29

sectors

  • defense 1 · Oct 30
  • nonprofit 1 · Oct 30
  • critical infrastructure 1 · Oct 29
  • energy 1 · Oct 29

geography

  • california 1 · Oct 29
  • hawaii 1 · Oct 29
  • texas 1 · Oct 29
  • united states 1 · Oct 29

malware and tools

  • keydrift 1 · Oct 30
  • littlefilch 1 · Oct 30
  • polyflame 1 · Oct 30
  • silent train 1 · Oct 29

techniques

  • auth bypass 1 · Oct 30
  • command and control 1 · Oct 30
  • credential access 1 · Oct 30
  • persistence 1 · Oct 30
  • relay 1 · Oct 29
  • zero day 1 · Oct 29

attack phases seen

  • Persistence 2 · Oct 30
  • Command and control 1 · Oct 30
  • Credential access 1 · Oct 30
  • Initial access 1 · Oct 29
  • Lateral movement 1 · Oct 29

what we reported, newest first, grouped by story

Oct 29 – October 30, 2026 · 2 reports

  • Talos detailed KeyDrift, a custom framework deployed on Catalyst SD-WAN Controllers via CVE-2026-20127, the max-severity auth bypass Cisco fixed in February. Components PolyFlame (runs inside legitimate vdaemon processes, TinyShell-style command execution, peer relaying) and LittleFilch (hooks SSL_read to extract control-session metadata and 32-byte AES-256 IPsec data-plane keys) target space and satellite services, defence and aerospace, and policy research organisations. Talos describes the intrusions as historical and says the UAT-11473 cluster overlaps Volt Typhoon's "Silent Train" covert access network without drawing a definitive link (BleepingComputer, SC World). (earlier coverage) · Oct 30 · observed · Exploitation at the Network Edge
  • Volt Typhoon runs its high-value intrusions through Silent Train, a relay framework of on-demand compromised devices that Lumen's Black Lotus Labs has tracked for three years. Operations route through non-US VPS, then hacked devices — Intelbras modems as overseas relays, Netgear Orbi as US hops — with temporary relays cleaned up after each operation and some enterprise hops persisting for months. Black Lotus confirmed at least four zero-days exploited through it (CVE-2026-16812 VeloCloud Orchestrator, CVE-2026-20127 Cisco Catalyst SD-WAN, CVE-2025-8875/CVE-2025-8876 N-able N-central, CVE-2024-39717 Versa Director) plus a suspected Quest KACE zero-day; targeting concentrates on California, Texas and Hawaii. The build-out followed the FBI's disruption of KV-Botnet (BleepingComputer, Lumen). · Oct 29 · observed · via edge device · Threat Activity