Monitor this situation.
Unsubscribe anytime.
[SITUATION] · [QUIET] · [TECHNOLOGY]
2 clusters · 8 sources · 4 days · First seen · Last updated
KeyDrift malware targeting Cisco SD-WAN systems
Overview
Cisco Talos identified KeyDrift, an advanced malware framework designed to target Cisco Catalyst SD-WAN controllers. The malware embeds itself within legitimate control-plane processes to maintain persistent access, intercept decrypted communications, and extract sensitive network encryption keys. Researchers noted that the operating infrastructure for this threat actor shows substantial overlap with the Silent Train network associated with Volt Typhoon.
Subsequent analysis by Lumen’s Black Lotus Labs and CERT-EU identified the malware, tracked as UAT-11473, as being used by a state-linked threat cluster to harvest AES-256 encryption keys. The framework exploited a maximum severity authentication bypass vulnerability, CVE-2026-20127. Evidence suggests this vulnerability was being exploited as a zero-day since 2023, prior to Cisco issuing a patch in February 2026.
KeyDrift utilizes two primary components: PolyFlame, a backdoor injected into the vdaemon process memory for persistent access, and LittleFilch, a module designed to harvest AES-256 encryption keys from decrypted SD-WAN control traffic. This enables the passive retrospective decryption of traffic between an organization’s sites. Confirmed targets include defense and aerospace technology, space and satellite services, and policy research organizations. Experts warn that while patching the vulnerability is necessary, it does not mitigate the risk of traffic intercepted during the period of exposure, necessitating comprehensive key rotation.
Entities
Cisco · Volt Typhoon · Cisco Talos · CERT-EU · Uganda National CERT and Coordination Center
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 2 SOURCES] The threat actor UAT-11473 is linked to the campaign using KeyDrift malware. que.com · cert.ug
- [● 2 SOURCES] The campaign exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco Catalyst SD-WAN products. que.com · cert.ug
- [● 2 SOURCES] LittleFilch is designed to extract AES-256 encryption key material. que.com · cert.ug
- [○ 1 SOURCE] The CVE-2026-20127 vulnerability has a CVSS score of 10.0. que.com
- [○ 1 SOURCE] The vulnerability may have been exploited as a zero-day starting in 2023. cert.ug
- [○ 1 SOURCE] KeyDrift consists of the PolyFlame backdoor and the LittleFilch data harvesting module. que.com
- [○ 1 SOURCE] Confirmed targets of the campaign include space, satellite, defense, and aerospace sectors. cert.ug
- [○ 1 SOURCE] Cisco released a patch for the authentication bypass in February 2026. cert.ug
Timeline
-
[TECHNOLOGY] 3 sourcesKeyDrift malware targets Cisco SD-WAN infrastructure
State-linked threat actor UAT-11473 used KeyDrift malware to exploit a critical Cisco SD-WAN vulnerability, potentially stealing encryption keys since 2023 to decrypt sensitive inter-site traffic.
-
[TECHNOLOGY] 6 sourcesCisco Talos identifies KeyDrift malware targeting SD-WAN controllers
Cisco Talos reports that KeyDrift malware targets SD-WAN controllers to steal encryption keys, impacting defense, aerospace, and satellite sectors.
Sources
cert.ug · comparethecloud.net · cryptobriefing.com · cybernoz.com · dev.to · que.com · saferworld.org.uk · theregister.co.uk
This summary has been updated 1 time: see revision history