Hackers exploit critical Cisco SD-WAN flaw to deploy KeyDrift malware that steals encryption keys

Cisco Talos reported on October 28 that a cyberespionage group exploited a maximum-severity flaw in Cisco Catalyst SD-WAN to plant custom malware designed to steal the encryption keys that protect traffic between sites. The flaw, tracked as CVE-2026-20127 and rated CVSS 10.0, lets an unauthenticated attacker bypass authentication and gain administrative control of SD-WAN components; Cisco disclosed it in February and says it is aware of limited exploitation. Talos describes the intrusions it analyzed as historical and does not say when they occurred or whether any keys were ultimately exfiltrated.

What happened

According to Talos, the attackers used CVE-2026-20127 to compromise Catalyst SD-WAN Controller, Manager and Validator systems and then deployed a malware family it calls KeyDrift. Cisco's advisory states the vulnerability affects these components "regardless of their configuration," covering both on-premises systems and Cisco's hosted cloud, Managed and FedRAMP deployments. Talos tracks the exploitation cluster as UAT-8616, with activity dating back to at least 2023, while naming the KeyDrift operators UAT-11473.

Technical details

In Cisco's design, each router periodically generates an AES key and relays it to other routers through the Controller's vdaemon process, which runs the encrypted control connections. A KeyDrift component named LittleFilch hooks into vdaemon and reads these control messages after decryption; for a preset list of edge routers it extracts their IP addresses and a 32-byte field that Talos assesses to be AES-256 key material. LittleFilch encrypts the collected data with RSA, writes it to a file and can send it over UDP to an address stored in a settings file that it then deletes. A second module, PolyFlame, is injected into vdaemon and can act as a TinyShell-like backdoor or relay commands hidden inside SD-WAN control traffic. For persistence, the group modified runit scripts, abused the SSH service and, on a Validator, created a fake aaamgr service, while using timestomping to blend in.

Who is affected

Talos says UAT-11473 has targeted space and satellite services, defense and aerospace technology, and policy research. The firm assesses with high confidence that the group's infrastructure "overlaps considerably" with Silent Train, the hacked-device network that Lumen's Black Lotus Labs tracks and that Lumen has tied to the Chinese state-sponsored actor Volt Typhoon. Separately, Lumen said on October 28 that Volt Typhoon had been exploiting the same CVE since late 2025; Talos links UAT-11473 to Volt Typhoon only through the shared infrastructure and does not call them the same group.

What to do

There is no workaround. Cisco and Talos recommend installing the fixed releases and following Cisco's Catalyst SD-WAN hardening guide; as an interim measure, access to ports 22 and 830 can be limited to known systems. Administrators should hunt for indicators such as conf_sshd, rsshd, aaamgrd, libdssl.so (PolyFlame) and libcommon.so (LittleFilch), check /var/log/auth.log for unexpected Accepted publickey for vmanage-admin entries, and deploy the Snort rules Talos released. Cisco warns that upgrading does not necessarily remove a pre-existing foothold, so suspected compromises need full investigation.