KeyDrift Stole Cisco SD-WAN Encryption Keys; Infrastructure Overlaps Volt Typhoon
Cisco Talos detailed on October 28 the KeyDrift malware, planted on Cisco Catalyst SD-WAN controllers through CVE-2026-20127 (CVSS 10.0), a flaw fixed in February 2026. The malware copies the keys protecting traffic between sites and keeps persistent access; Talos assesses with high confidence that UAT-11473's infrastructure overlaps the Silent Train network used by Volt Typhoon and documented by Lumen. The attacks are historical and the flaw is patched: apply the fix and investigate persistence on controllers.
What happened
Cisco Talos revealed KeyDrift, malware installed on Cisco SD-WAN controllers through a critical flaw that is already fixed. The program copies the keys protecting traffic between sites and keeps ongoing access to the equipment.
Why it matters
With those keys, an attacker can read encrypted traffic between sites and change the network's configuration. According to Lumen, Volt Typhoon used the same flaw against telecoms, government, defense, MSPs and US critical infrastructure, in activity assessed as preparation for a geopolitical crisis.
What to do
Apply the February 2026 fix on Catalyst SD-WAN controllers and investigate signs of intrusion, since the attacks are historical and may have left hidden access.
For the technical team
- CVE
- CVE-2026-20127
- Affected
- Cisco SD-WAN · Cisco Catalyst SD-WAN controllers. Specific versions not cited in the sources.
- Exploitation
- Exploitation confirmed by Cisco Talos in historical attacks, with no dates specified. Lumen Black Lotus Labs reports Volt Typhoon was exploiting CVE-2026-20127 by late 2025 and kept doing so after the February 2026 disclosure. Talos attributes the attacks to UAT-11473, a highly sophisticated APT targeting space and satellite services, defense and aerospace technology, and policy research.
- Fix
- Flaw fixed in February 2026. Specific fixed versions not cited in the sources.
- Vector
- Cisco Catalyst SD-WAN, CVE-2026-20127 (CVSS 10.0). Remote exploitation without credentials: bypasses peering authentication of SD-WAN controller components and obtains admin rights, according to SecurityWeek. Cisco warns this access can be leveraged to alter the SD-WAN network's configuration.
- More details
- KeyDrift is injected into legitimate control-plane processes and accesses traffic after decryption. The PolyFlame module works as a backdoor and intermediate C2 relay; LittleFilch collects keying material Talos assesses includes data-plane keys. Talos assesses with high confidence that UAT-11473's infrastructure overlaps considerably with Volt Typhoon's Silent Train covert access network, without saying they are the same group. Lumen has monitored Silent Train since late 2023, issued hundreds of victim notifications, and tied the network to at least four confirmed zero-day campaigns (Versa Director, N-able N-central, Cisco Catalyst SD-WAN and VeloCloud Orchestrator), plus a likely zero-day against Quest KACE. Victims include telecoms, government entities, defense contractors, satellite and mission-critical communications providers, MSPs, universities with military ties and critical infrastructure operators, with Hawaii, California and Texas targeted the most. Lumen researcher Mike Horka said documents on military operations and network structures were exfiltrated.
Timeline
BleepingComputer covers the campaign exploiting the Cisco SD-WAN flaw to deploy the custom KeyDrift malware, adding no new details beyond Talos' report.
Talos says KeyDrift infrastructure overlaps Volt Typhoon's 'Silent Train' network, previously detailed by Lumen.
Coverage confirms the Cisco Catalyst SD-WAN flaw used in the attacks was fixed in February.
Want the next updates in your inbox? Get the daily edition →
See all 5 updates
New report notes the Cisco SD-WAN flaw is rated CVSS 10.0 and links KeyDrift infrastructure to a network used by the Volt Typhoon group.
Incident opened.
Sources 5 sources
- @DailyDarkWeb @DailyDarkWeb
- @TheHackersNews @TheHackersNews
- Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys The Hacker News
- Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon's ‘Silent Train' Network SecurityWeek
- @BleepinComputer @BleepinComputer
