Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware

A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift.

CVE-2026-20127 is a max-severity flaw that Cisco patched in February 2026, which allows remote attackers to gain privileged access to Catalyst SD-WAN Controller and Manager and add rogue peers.

UAT-8616 has exploited the vulnerability as a zero-day since at least 2023, and recent research also linked its exploitation to the Chinese Volt Typhoon state-sponsored hacking group.

According to Cisco Talos researchers who reported on the activity, the UAT-11473 threat cluster appears to overlap with Volt Typhoon’s "Silent Train" covert access network, but they made no definitive links.

In a report Lumen released yesterday, researchers revealed that the Silent Train framework allowed Volt Typhoon to evade detection while conducting zero-day vulnerability attacks.

Deploying KeyDrift

The attacks Cisco researchers observed targeted space and satellite services, defense and aerospace technology, and policy research organizations, using the KeyDrift malware, which is a custom malware framework designed to operate on Cisco SD-WAN controller instances.

"Talos assesses with high confidence that the framework is designed to provide long-term persistent access and automated exfiltration of sensitive keying material," explained Cisco Talos.

"KeyDrift operates inside SD-WAN control-plane processes and is capable of intercepting decrypted control traffic, extracting control-session metadata and data-plane keying material, and staging or transmitting the collected material using encrypted records."

KeyDrift has two primary components, PolyFlame and LittleFilch, for which Talos saw signs of ongoing development, including new anti-debugging mechanisms and varied process impersonation.

PolyFlame runs inside legitimate vdaemon processes using modified service startup scripts and an injector for deployment.

It supports command execution through a TinyShell-styled component, file uploads and downloads, and relaying communications between an attacker’s command-and-control (C2) server and multiple peers.

LittleFilch is a control-session interception module that hooks SSL_read to inspect control-plane messages after they have been decrypted inside the controller.

For predefined edge nodes, it extracts IP identifiers and a 32-byte field that Talos assesses to be AES-256 IPsec data-plane key material.

It uses RSA encryption to protect the collected information, saves it to /var/tmp/vdaemon.bin, and then transmits it over UDP to the attackers.

Talos believes with high confidence that KeyDrift is designed to maintain persistent access to Cisco SD-WAN controllers, intercept control-plane traffic, extract cryptographic keys, and securely stage or exfiltrate the stolen data.

Cisco recommends that system administrators apply the available security updates for CVE-2026-20127 and also consult the vendor’s dedicated hardening guide for Catalyst SD-WAN deployments.

Once attackers have valid credentials, only 37% of their actions are blocked

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report