UAT-8616

UAT-8616 is a highly sophisticated threat actor cluster tracked by Cisco Talos. Cisco attributes exploitation activity against Cisco Catalyst SD-WAN infrastructure to this actor with high confidence, with activity dating back to at least 2023. The group has been linked to zero-day exploitation of the authentication bypass vulnerabilities CVE-2026-20127 and CVE-2026-20182 to gain unauthorized administrative access to Cisco SD-WAN systems, including by creating rogue peers through the peering authentication mechanism. Reported post-compromise actions include adding SSH keys, modifying NETCONF configurations, escalating privileges to root, and in previously detected attacks downgrading software versions to exploit CVE-2022-20775 for root access before restoring the original version. Reporting also describes a reconstructed intrusion chain involving unauthorized peering, SSH access as vmanage-admin, use of CVE-2026-20245 for root compromise, creation of a hidden UID 0 account, and anti-forensic restoration of modified system files. Cisco says the actor targets critical infrastructure sectors. Multiple reports describe overlap between infrastructure used by UAT-8616 and Operational Relay Box networks; some reporting characterizes the actor as alleged China-nexus, but the content also states UAT-8616 has not been formally attributed to a specific country or named group. Known alias in the provided content: uat_8616.