Forest Global Training Partners

Cyber Risks · Cisco Talos

Talos on the developing situation in Ukraine

Summary: Cisco Talos reports a shift in activity in response to the invasion of Ukraine, with indicators of compromise for HermeticWiper and WhisperKill published in separate Talos blogs and primary guidance continuing to follow CISA's Shields Up recommendations. Talos also describes a volunteer OSINT force of over 500 Cisco teammates watching Ukrainian networks, alongside staff working on refugee relief, and separately identifies the APT UAT-11473 exploiting CVE-2026-20127, an authentication bypass in Cisco SD-WAN Catalyst Controller instances, to deploy KeyDrift.

What you should know: An authentication bypass in SD-WAN Catalyst Controller instances, exploited by a highly sophisticated APT to deploy KeyDrift, puts the network control plane itself in the blast radius rather than a single endpoint. Talos is leaning on more than 500 volunteer teammates to watch Ukrainian networks, a scale of response that signals how far the defender's workload has stretched.

Read the original at Cisco Talos ↗

Topics
Malware
Mentions
CVE-2026-20127
Related