Researchers at Cisco Talos reported on October 28 that custom malware, named KeyDrift, was deployed inside the systems governing an organization's SD-WAN network by exploiting a significant vulnerability in Cisco Catalyst SD-WAN. This malware is engineered to capture the keys used to encrypt traffic between various sites and retain them for subsequent use.
An advanced persistent threat (APT) group identified as UAT-11473 was observed leveraging CVE-2026-20127, which is an authentication-bypass flaw present in Cisco Catalyst SD-WAN Controllers, to deploy this bespoke malware framework. This vulnerability, rated as max-severity, was patched by Cisco in February 2026; it permits remote attackers to attain elevated access to both the Catalyst SD-WAN Controller and Manager, enabling them to introduce unauthorized peers. Furthermore, UAT-8616 has been utilizing this vulnerability as a zero-day exploit since at least 2023, and recent investigations have also connected its exploitation to the Chinese state-sponsored hacking entity, Volt Typhoon.
Cisco Talos researchers who documented this activity noted that the UAT-11473 threat cluster exhibits similarities with Volt Typhoon's "Silent Train" covert access network, although they refrained from asserting a definitive connection. In a report published yesterday by Lumen, analysts uncovered that the Silent Train framework enabled Volt Typhoon to conduct zero-day vulnerability attacks while successfully evading detection. The attacks observed by Cisco researchers were directed toward entities in the space and satellite services sector, defense and aerospace technology, and policy research organizations, utilizing the KeyDrift malware, which is a custom framework designed to operate within Cisco SD-WAN controller instances.
Cisco Talos explained, "Talos assesses with high confidence that the framework is designed to provide long-term persistent access and automated exfiltration of sensitive keying material." The operations of KeyDrift occur within the SD-WAN control-plane processes, allowing it to intercept decrypted control traffic, pull out control-session metadata, and extract data-plane keying material, subsequently staging or transmitting the gathered material using encrypted records.
KeyDrift comprises two principal components: PolyFlame and LittleFilch; Talos has observed signs of ongoing development for these components, including the introduction of novel anti-debugging measures and varied process impersonation techniques. PolyFlame is deployed by running within legitimate vdaemon processes, utilizing modified service startup scripts and an injector. This component facilitates command execution via a TinyShell-like element, alongside the capability to upload and download files, and to relay communications between an attacker's command-and-control (C2) server and multiple peers. LittleFilch functions as a control-session interception module; it hooks SSL_read to examine control-plane messages after they have been decrypted inside the controller. For established edge nodes, it retrieves IP identifiers and a 32-byte field that Talos judges to be AES-256 IPsec data-plane key material. This information is then protected using RSA encryption, saved to the location /var/tmp/vdaemon.bin, and transmitted via UDP to the attackers.
Talos maintains with high confidence that KeyDrift's design intent is to sustain persistent access to Cisco SD-WAN controllers, capture control-plane traffic, extract cryptographic keys, and securely stage or exfiltrate the compromised data. System administrators are advised by Cisco to implement the security updates available for CVE-2026-20127 and to refer to the vendor’s specific hardening guide for Catalyst SD-WAN deployments. The Blue Report 2026 indicates that overall prevention scores may obscure the actions taken subsequent to initial access, as defense effectiveness declines sharply once adversaries possess valid credentials.
This incident highlights the evolving sophistication of threats targeting critical network infrastructure components. The observed exploitation of a flaw in a core SD-WAN control plane, coupled with the malware's ability to target encryption keys, underscores the operational risks associated with maintaining complex, interconnected platform services.
Why it matters
This highlights the severe risk of supply chain compromise within critical network infrastructure like SD-WAN. Operators must prioritize patching vulnerabilities like CVE-2026-20127 to prevent long-term, persistent access and data exfiltration.
