KeyDrift malware targeted Cisco SD-WAN encryption keys

Cisco Talos has described historical attacks in which adversaries exploited CVE-2026-20127, a critical Cisco Catalyst SD-WAN vulnerability with a CVSS score of 10.0, to deploy malware designed to collect traffic-encryption key material. The malware family, dubbed KeyDrift, was planted on SD-WAN control-plane systems and includes components that can capture data handled by the Controller’s vdaemon process.

The vulnerability affects Catalyst SD-WAN Controller, formerly vSmart, Manager, formerly vManage, and Validator, formerly vBond, irrespective of configuration. It applies to on-premises deployments as well as Cisco-hosted SD-WAN cloud deployments, including Cisco Managed and FedRAMP environments. Cisco said it is aware of limited exploitation and has no workaround.

How KeyDrift targets SD-WAN control traffic

CVE-2026-20127 allows an unauthenticated remote attacker to bypass authentication and gain administrative privileges on affected control systems. On a Controller, the attacker can sign in through a high-privileged internal account that is not root. Cisco disclosed the flaw in February, while Talos tracked exploitation activity as UAT-8616 going back to at least 2023.

In Cisco’s traditional key-exchange design, SD-WAN routers periodically generate AES keys and send them to the Catalyst SD-WAN Controller, which distributes them to other routers. KeyDrift’s LittleFilch component hooks vdaemon, the process responsible for encrypted control connections, and reads control messages after decryption. For a preset list of edge routers, it extracts IP addresses and a 32-byte field that Talos assesses to be AES-256 key material.

LittleFilch encrypts the collected records with RSA, writes them to a file and can transmit them over UDP using settings read from a configuration file that is deleted afterwards. Talos could not recover that settings file and did not state whether any captured keys were exfiltrated. The campaign adds another Cisco-focused case to Cisco vulnerability threats and ClickFix attack chains while underscoring the value of monitoring compromise activity beyond an initial vulnerability alert.

Persistence and remote-control capabilities

Talos said KeyDrift commonly starts through modified runit scripts used to launch Cisco SD-WAN services. In one observed path, the SSH service script launches conf_sshd before the legitimate SSH daemon. That script records vdaemon process IDs, and rsshd injects the PolyFlame module into those processes.

PolyFlame runs in memory within vdaemon and can operate as a TinyShell-like backdoor for command execution and file operations, or relay commands between a command server and other systems. It accepts commands carried within SD-WAN control traffic; the analysed samples contained no hardcoded server address. On a compromised Validator, Talos also observed a fake aaamgr service under /etc/sv/aaamgr/ that launches aaamgrd, a packed loader for PolyFlame.

The group tracked as UAT-11473 has targeted space and satellite services, defence and aerospace technology, and policy research. Talos assessed with high confidence that its infrastructure overlaps considerably with Silent Train. It linked UAT-11473 to Volt Typhoon only through that overlap and did not conclude that the groups are the same.

Upgrade and investigate affected systems

Cisco’s first fixed releases include 20.9.8.2 for the 20.9 train, 20.12.6.1 for 20.11, 20.12.5.3 or 20.12.6.1 for 20.12, 20.15.4.2 for 20.13 through 20.15, and 20.18.2.1 for 20.16 and 20.18. Releases earlier than 20.9 and several affected trains have reached end of software maintenance, requiring migration to a supported fixed release.

Until an on-premises upgrade is complete, Cisco advises limiting ports 22 and 830 to known controllers and systems, subject to local validation. That measure does not remove malware already installed. Organisations should inspect modified SSH run scripts, the fake Validator service, conf_sshd, rsshd, libdssl.so, libcommon.so, /tmp/system-vdaemon and files under /var/tmp, then begin incident response when signs of compromise appear. The practical implication is to pair patching with forensic checks and access restrictions, because a successful upgrade alone may not address pre-existing KeyDrift persistence.