Hackers Used a Cisco SD-WAN Flaw to Deploy KeyDrift, Malware Built to Steal Encryption Keys

Attackers exploited a critical Cisco Catalyst SD-WAN vulnerability, patched back in February, to install custom malware on the systems that control an organization's SD-WAN network. The malware, KeyDrift, copies the keys that encrypt traffic between sites and stores them for later use, Cisco Talos reported on October 28. Talos calls the attacks historical but does not say when they took place or whether any keys were actually sent anywhere.

The flaw, CVE-2026-20127, carries a CVSS score of 10.0. It lets an unauthenticated remote attacker bypass authentication and gain administrative privileges on the control systems. In February, Talos tied its exploitation to an activity cluster called UAT-8616, which it said dates back to at least 2023.

How KeyDrift works

In Cisco's traditional key exchange, each SD-WAN router periodically generates an AES key and sends it to the Catalyst SD-WAN Controller (formerly vSmart), which passes the keys on to other routers. The encrypted control connections are handled by a process called vdaemon.

A component named LittleFilch hooks into vdaemon and reads control messages after they are decrypted. For a preset list of edge routers, it extracts IP addresses and a 32-byte field that Talos assesses as AES-256 key material. The data is encrypted with RSA, written to a file, and can be sent over UDP to an address taken from a settings file that is deleted after reading. Talos was unable to recover that file.

The main module, PolyFlame, runs in memory inside vdaemon. It can act as a TinyShell-like backdoor or as a command relay. It accepts commands inside SD-WAN control traffic, so the analyzed samples contain no hardcoded server address. Persistence comes from modified runit scripts. On a Validator (formerly vBond), the attackers set up a fake aaamgr service. They also timestomped their files, copying timestamps and permissions from existing ones.

Who is behind it

Talos tracks the group as UAT-11473. It has targeted space and satellite services, defense and aerospace technology, and policy research. Its infrastructure, Talos says, "overlaps considerably" with Silent Train, the name Lumen's Black Lotus Labs uses for a network of hacked SOHO, IoT and business devices that Volt Typhoon used. CISA, the NSA and the FBI have identified Volt Typhoon as Chinese state-sponsored. Talos stops short of calling the two the same group and does not explain how UAT-11473 relates to UAT-8616. Lumen separately said Volt Typhoon was exploiting CVE-2026-20127 by late 2025, but does not link that activity to KeyDrift.

What to do

The flaw affects Controller, Manager and Validator in any configuration, both on-premises and in Cisco's hosted cloud deployments, including the Cisco Managed and FedRAMP environments. There is no workaround: customers need to upgrade, and those on out-of-maintenance trains need to migrate to a supported release. Until then, on-premises customers are advised to restrict ports 22 and 830 to known systems, though that does not remove malware already present.

Talos has released Snort rules to detect KeyDrift command-and-control connections and listed the files the malware uses. The report includes no hashes, IP addresses or domains. It also remains unclear whether upgrading removes KeyDrift from a compromised device or whether keys should be rotated. Cisco's February remediation guide warns that exploits planted before an upgrade may still be in place.

Source: The Hacker News