Hackers exploited a critical Cisco Catalyst SD-WAN vulnerability to install custom malware capable of collecting encryption keys used to protect communications between network sites.
The malware, named KeyDrift, targets the systems that manage an organization’s SD-WAN infrastructure and can maintain persistent access, intercept network control traffic, and potentially expose sensitive cryptographic material.
Cisco Talos detailed the attacks in a report published on October 28, 2026, identifying the activity under the tracking name UAT-11473. Researchers said the attackers exploited CVE-2026-20127, a critical authentication bypass vulnerability that allows unauthenticated remote attackers to gain administrative privileges on affected Cisco SD-WAN control systems.
Talos described the activity as historical but did not establish exactly when the attacks took place or confirm whether any stolen encryption keys were successfully transmitted to the attackers. The researchers assessed with high confidence that KeyDrift was designed to maintain long-term access and automatically collect sensitive keying material from compromised systems.
CVE-2026-20127 carries a CVSS score of 10.0, the highest possible severity rating. Cisco disclosed the vulnerability on February 25, 2026, explaining that a weakness in its peering authentication mechanism could allow remote attackers to bypass authentication and access an affected Catalyst SD-WAN Controller using a highly privileged internal account that does not have root privileges. From there, an attacker could access NETCONF and manipulate the network configuration of the SD-WAN infrastructure.
The vulnerability affects Cisco Catalyst SD-WAN Controller, formerly vSmart, Manager, formerly vManage, and Validator, formerly vBond, regardless of their configuration. Both on-premises deployments and Cisco-hosted environments, including Managed and FedRAMP deployments, are affected. Cisco added the Validator to its advisory on June 16.
KeyDrift consists of several components that work together to establish persistence, intercept communications and collect encryption material. Its main component, PolyFlame, runs in memory inside legitimate Cisco SD-WAN processes. Another component, LittleFilch, extracts sensitive information from decrypted control-plane messages.
Cisco’s SD-WAN architecture uses encryption keys to protect traffic between edge routers. Under its traditional key-distribution process, routers generate AES keys and share them through the Catalyst SD-WAN Controller, which distributes the necessary key material to other routers. KeyDrift takes advantage of this process by operating inside the software that handles those communications.
On a compromised controller, LittleFilch hooks into the vdaemon process and monitors data after it has been decrypted. It searches control messages for information associated with predefined edge routers, including their public IP addresses, system identifiers and a 32-byte binary field. Talos assesses that the field contains AES-256 IPsec data-plane key material distributed through the network’s control plane.
LittleFilch encrypts the collected information using RSA and writes it to /var/tmp/vdaemon.bin. It can also transmit the encrypted records over UDP to a destination specified in a configuration file at /var/tmp/vdaemon.conf. The configuration file contains local and remote network endpoint information and is deleted after being read. Talos said investigators could not recover the file, leaving the intended destination and any successful transfer of the collected keys unconfirmed.
PolyFlame provides the malware’s backdoor and command-relaying capabilities. It can execute commands, read and write files, and forward communications between a command server and other compromised machines. Rather than relying on a conventional, hardcoded command-and-control address, the malware is designed to accept tasking through Cisco SD-WAN control-plane traffic. Talos did not recover hardcoded IP addresses, domains, URLs or polling intervals from the analyzed samples.
The attackers establish persistence by modifying runit service scripts that launch Cisco SD-WAN services. In one observed method, the SSH service’s startup script launches a malicious loader called conf_sshd before starting the legitimate SSH server. The loader identifies running vdaemon processes and records their process IDs in /tmp/system-vdaemon. A separate tool, rsshd, then injects PolyFlame, stored as libdssl.so, into those processes.
Talos also identified a second deployment method targeting an SD-WAN Validator. In this case, attackers created a fake aaamgr service under /etc/sv/aaamgr/ and used a packed executable called aaamgrd to decrypt and launch the PolyFlame payload. Cisco’s legitimate aaamgr component is a Python package and does not normally operate as a compiled service. Researchers also found evidence of timestomping, a technique that copies timestamps and permissions from existing files to make malicious files appear more legitimate.
The activity has been linked to a threat cluster that Talos tracks as UAT-11473. Its observed targets include space and satellite service providers, defense and aerospace technology organizations, and policy research institutions.
Talos also found substantial overlap between UAT-11473’s infrastructure and Silent Train, a covert network of compromised small-office, home-office, Internet of Things and business devices documented by Lumen’s Black Lotus Labs. The network has been associated with Volt Typhoon, a Chinese state-sponsored cyber group known for using compromised infrastructure to conceal its operations.
However, the infrastructure overlap does not establish that UAT-11473 and Volt Typhoon are the same threat actor. Talos has also not explained how the newly documented UAT-11473 activity relates to UAT-8616, a separate tracking cluster associated with exploitation of the Cisco vulnerability and reported by Talos in February.
Separately, Lumen reported on October 28 that Volt Typhoon had been exploiting CVE-2026-20127 by late 2025 and continued exploiting the flaw after Cisco disclosed it in February 2026. Lumen attributed that activity to Volt Typhoon through its Silent Train investigations but did not directly connect the exploitation to KeyDrift.
Cisco says it is aware of limited exploitation of CVE-2026-20127 and has released software updates to address the flaw. The first fixed releases include version 20.9.8.2 for the 20.9 train, version 20.12.6.1 for 20.11, and versions 20.12.5.3 or 20.12.6.1 for 20.12, depending on the release. Versions 20.13, 20.14 and 20.15 require version 20.15.4.2, while versions 20.16 and 20.18 require version 20.18.2.1. Deployments running releases earlier than 20.9 must migrate to a fixed release. Several affected release trains have reached the end of software maintenance, and Cisco recommends moving to supported software.
For organizations unable to upgrade immediately, Cisco recommends restricting access to ports 22 and 830 to known controller addresses and other trusted systems. The company says the mitigation was successful in a test environment, but organizations should assess its impact and effectiveness before implementing it. These access restrictions are already in place for Cisco’s hosted SD-WAN cloud deployments. Cisco emphasizes that such restrictions are temporary measures and do not remove malware from systems that have already been compromised.
Talos recommends applying the available patches, following Cisco’s Catalyst SD-WAN hardening guidance and checking for evidence of post-compromise activity. Organizations that identify suspicious activity should initiate incident response and contact Cisco’s Technical Assistance Center for assistance. An upgrade should not be treated as proof that a previously compromised system has been cleaned, as Cisco’s February remediation guidance warned that malicious artifacts could remain after a patch is applied.
Defenders can look for changes to the SSH startup script under /etc/sv/sshd/, the suspicious /etc/sv/aaamgr/ service directory, and files associated with the malware, including aaamgrd, conf_sshd, rsshd, libdssl.so and libcommon.so. Other relevant locations include /tmp/system-vdaemon, /var/tmp/vdaemon.bin and /var/tmp/vdaemon.conf. Talos has not published KeyDrift-specific file hashes, IP addresses or domains, which limits detection based solely on conventional indicators of compromise.
Cisco Talos released additional Snort detection rules on October 28 to identify inbound connections associated with KeyDrift command-and-control activity. The rules cover Snort 2 signatures 67387 through 67416 and Snort 3 signatures 7:44 through 7:73. Existing Snort signatures 65938 and 65958 detect activity associated with CVE-2026-20127 itself. The new Snort 2 signatures are disabled by default in the Subscriber rule set and must be enabled manually.
Cisco also recommends checking /var/log/auth.log for entries containing Accepted publickey for vmanage-admin that originate from unfamiliar IP addresses. Before opening a support case, organizations should run request admin-tech on each control component and use Cisco’s Bug Search Tool to check the resulting files with the Check Bug Applicability feature for bug CSCws52722.
For US federal civilian agencies, the Cybersecurity and Infrastructure Security Agency’s February 25 emergency directive sets out additional remediation steps when a root-account compromise is discovered. These include reporting the incident to CISA, deploying fresh Manager, Controller and Validator instances from patched images, and migrating edge routers to the replacement systems.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
The latest findings underscore the importance of investigating suspected compromises as well as patching the underlying vulnerability. Organizations using Cisco Catalyst SD-WAN should install the fixed releases, review their access controls, investigate suspicious administrative logins and assess whether their control systems remain compromised.
