Talos finds KeyDrift malware stealing Cisco SD-WAN traffic keys

Talos finds KeyDrift malware stealing Cisco SD-WAN traffic keys

28 October 2026: Cisco Talos has described KeyDrift, a malware framework planted on Cisco Catalyst SD-WAN Controllers through CVE-2026-20127, an authentication bypass rated CVSS 10.0 that Cisco patched in February. Once inside, it reads the control traffic the Controller decrypts and copies the AES keys that edge routers use to encrypt traffic between sites. Talos calls the activity historical and does not say when it happened or whether keys left the networks it studied.

How the implant sits inside the Controller

KeyDrift is anchored in the runit service scripts that SD-WAN appliances use to start their daemons. In one variant, the script that starts the SSH service first remounts the root filesystem as writable and executable, launches a loader script named conf_sshd in the background, and only then starts the real SSH server. The loader records the process IDs of vdaemon, the process that runs the encrypted control connections, and a tool called rsshd injects the main module into each of them. A second variant, recovered from a Validator (formerly vBond), runs a packed loader through the aaamgr service script instead.

The main module, PolyFlame, runs in memory inside vdaemon and hooks socket and DTLS functions such as recvfrom and sendto. It acts as a TinyShell-style backdoor that runs commands and moves files, or as a relay that passes commands on to other compromised peers. Talos recovered no fixed command server, port or domain from the samples: tasking arrives inside the SD-WAN control traffic itself, and the implant only acts when the controller sends an MD5 hash of the current date that matches its own.

A second module, LittleFilch, hooks SSL_read inside vdaemon. For a preset list of edge routers it pulls their addresses and a 32-byte field that Talos assesses is the AES-256 key material the Controller passes between routers, encrypts what it collects with RSA and stages it in a file for sending out over UDP.

Who is behind it

Talos tracks the operator as UAT-11473 and says its targets span space and satellite services, aerospace technology and policy research. Its infrastructure "overlaps considerably", in Talos's words, with Silent Train, the network of hijacked small-office, IoT and business devices that Lumen's Black Lotus Labs says Volt Typhoon uses to hide its traffic. Talos draws the link through infrastructure only and does not say the groups are the same, or how UAT-11473 relates to UAT-8616, the cluster it tied to exploitation of the same flaw in February. Variations between samples suggest the framework is still being developed.

What SD-WAN owners should check now

Patching CVE-2026-20127 closes the way in but does not remove an implant already running, and Talos tells organisations to look for signs of post-compromise activity. On Controllers and Validators that were exposed before they were patched, that means:

• runit service scripts for sshd and aaamgr that differ from the shipped versions, or that remount /rootfs.rw executable;
• files named conf_sshd, rsshd or libdssl.so, and a /tmp/system-vdaemon file of process IDs;
• unexpected modules mapped into vdaemon processes.

Where a Controller is found compromised, the keys it distributed should be treated as exposed and rotated once the device has been rebuilt.

Cisco's first fixed releases for CVE-2026-20127 are 20.9.8.2, 20.12.5.3 or 20.12.6.1, 20.15.4.2 (for the 20.13, 20.14 and 20.15 trains) and 20.18.2.1 (for 20.16 and 20.18). Releases older than 20.9 and the 20.11 train have to move to a fixed train. The flaw has been on CISA's Known Exploited Vulnerabilities list since 25 February. We covered a separate exploited bypass in the same product, CVE-2026-76504 in SD-WAN Manager, and today's ASA and FTD VPN flaw is also under attack.

Sources

• Cisco Talos: Inside KeyDrift, analyzing historical UAT-11473 activity on Cisco SD-WAN, 28 October 2026
• Cisco Security Advisory cisco-sa-sdwan-rpa-EHchtZk (CVE-2026-20127), 25 February 2026
• NVD: CVE-2026-20127, 25 February 2026
• The Hacker News: Hackers exploited Cisco SD-WAN flaw to plant malware built to steal encryption keys, 29 October 2026