Cisco Talos: Hackers Used Maximum-Severity SD-WAN Flaw to Plant KeyDrift Malware Built to Copy Encryption Keys

A perfect-score vulnerability in Cisco's SD-WAN software was used to install custom spyware on the systems that run corporate networks. Cisco Talos described the malware, named KeyDrift, on Wednesday, Oct. 28.

The flaw is CVE-2026-20127. It carries a CVSS score of 10.0, the maximum. An unauthenticated remote attacker can bypass authentication and gain administrative privileges on Catalyst SD-WAN control systems. Cisco disclosed it and shipped fixes in February.

Talos calls the KeyDrift attacks "historical." It has not said when they took place.

What KeyDrift does

Talos assesses with high confidence that KeyDrift is built for long-term, persistent access to SD-WAN controllers and automated theft of keying material.

In Cisco's standard setup, each SD-WAN router periodically generates an AES key for its traffic and sends it to the Controller, formerly called vSmart. The Controller passes the keys to other routers. A process called vdaemon runs the encrypted control connections that carry them.

KeyDrift sits inside that process. Its main component, PolyFlame, is a memory-resident module injected into running vdaemon processes. Talos says it can also masquerade as a packed "aaamgrd" loader.

A second component, LittleFilch, hooks SSL_read inside vdaemon and reads control messages after they are decrypted. For a preset list of edge routers, it pulls the IP addresses and a 32-byte field that Talos assesses is AES-256 key material.

LittleFilch encrypts the haul with RSA and writes it to a file. It can send the data over UDP to an address in a settings file, which the malware deletes after reading. Talos could not recover that file. Whether any keys actually left a victim's network remains unanswered.

Talos also reports that variations in the modules and deployment methods suggest the framework is under active development.

Who is behind it

Talos tracks the operator as UAT-11473. The group has targeted space and satellite services, defense and aerospace technology, and policy research.

Talos assesses with high confidence that the group's infrastructure "overlaps considerably" with Silent Train. That is the name Lumen's Black Lotus Labs gives to a network of hacked small-office, home-office, IoT and business devices. Lumen says Volt Typhoon used that network to hide its activity. CISA, the NSA and the FBI said in 2024 that Volt Typhoon is a Chinese state-sponsored cyber group.

The link has limits. Talos ties UAT-11473 to Volt Typhoon only through the shared infrastructure. It does not say they are the same group. It also does not explain how UAT-11473 relates to UAT-8616, the cluster it tracked when Cisco disclosed the flaw in February. Talos said at the time that UAT-8616 activity went back to at least 2023.

Separately, Lumen said on Oct. 28 that Volt Typhoon was exploiting CVE-2026-20127 by late 2025 and kept doing so after Cisco's February disclosure. Lumen does not connect that activity to KeyDrift.

How KeyDrift hangs on

The malware mainly starts through modified runit scripts, which Cisco SD-WAN devices use to launch services. In one version, the SSH service script remounts /rootfs.rw as executable and launches a loader script, conf_sshd, in the background before starting the real SSH server. The loader records vdaemon process IDs in /tmp/system-vdaemon and calls an injector called rsshd to push PolyFlame, delivered as libdssl.so, into each one.

Because the legitimate SSH service still starts normally, nothing looks broken. Talos found a parallel setup on an affected vBond appliance, where the aaamgr launcher was altered.

What administrators are told to do

The flaw affects the Controller, Manager and Validator, both on-premises and in Cisco's cloud-hosted instances. Cisco says there is no workaround. The first fixed releases are 20.9.8.2 in the 20.9 line, 20.12.6.1 in the 20.11 and 20.12 lines, 20.15.4.2 in the 20.13 through 20.15 lines, and 20.18.2.1 in the 20.16 and 20.18 lines. Versions older than 20.9 have to migrate to a supported release.

Until patching is done, restricting ports 22 and 830 to known controller IP addresses is the recommended stopgap. That does nothing about malware already on a device.

For hunting, the indicators Talos points to include:

• Changed SSH execution scripts
• A spoofed aaamgr process on a validator
• The files libdssl.so, libcommon.so and /var/tmp/vdaemon.bin
• The string "Accepted public key for vmanage-admin" in /var/log/auth.log, coming from unfamiliar IP addresses

Talos published Snort rules on Wednesday.

The fixes have been out since February, and Talos says the intrusions are in the past. That does not tell any network owner whether its own controller was hit before it updated. Cisco's own remediation guide warns that there could be "existing exploits which are still in place" from before an upgrade, and blocking ports does not remove malware already on a device. With the settings file unrecovered, no one outside the attackers can say where any copied keys went.

Talos has not said when the KeyDrift intrusions happened or how many organizations were affected.