Cisco Talos identifies KeyDrift malware targeting SD-WAN controllers

Cisco Talos has uncovered KeyDrift, an advanced malware framework designed to target Cisco Catalyst SD-WAN controllers. The malware embeds itself within legitimate control-plane processes to maintain persistent access, intercept decrypted communications, and extract sensitive network encryption keys.

Targets of these attacks include defense and aerospace technology, space and satellite services, and policy research organizations. The malware exploits defective peering authentication, allowing unauthenticated remote attackers to gain access through highly privileged internal accounts. This access also enables the manipulation of SD-WAN fabric configurations via NETCONF functionality.

Researchers noted that the operating infrastructure for this threat actor shows substantial overlap with the Silent Train network associated with Volt Typhoon. The KeyDrift framework utilizes modified service launchers to inject PolyFlame into daemon processes, allowing it to hook socket and runtime behavior while avoiding the footprint of a separate endpoint beacon.