# KeyDrift malware targeting Cisco SD-WAN systems

> Developing situation record from CLSTR: https://clstr.news/situations/keydrift-malware-targeting-cisco-sd-wan-systems
> Updated: 2026-11-02T17:40:12.000Z. Sources: 8. Developments: 2.

Cisco Talos identified KeyDrift, an advanced malware framework designed to target Cisco Catalyst SD-WAN controllers. The malware embeds itself within legitimate control-plane processes to maintain persistent access, intercept decrypted communications, and extract sensitive network encryption keys. Researchers noted that the operating infrastructure for this threat actor shows substantial overlap with the Silent Train network associated with Volt Typhoon.

Subsequent analysis by Lumen’s Black Lotus Labs and CERT-EU identified the malware, tracked as UAT-11473, as being used by a state-linked threat cluster to harvest AES-256 encryption keys. The framework exploited a maximum severity authentication bypass vulnerability, CVE-2026-20127. Evidence suggests this vulnerability was being exploited as a zero-day since 2023, prior to Cisco issuing a patch in February 2026.

KeyDrift utilizes two primary components: PolyFlame, a backdoor injected into the vdaemon process memory for persistent access, and LittleFilch, a module designed to harvest AES-256 encryption keys from decrypted SD-WAN control traffic. This enables the passive retrospective decryption of traffic between an organization’s sites. Confirmed targets include defense and aerospace technology, space and satellite services, and policy research organizations. Experts warn that while patching the vulnerability is necessary, it does not mitigate the risk of traffic intercepted during the period of exposure, necessitating comprehensive key rotation.

## Claims

- The threat actor UAT-11473 is linked to the campaign using KeyDrift malware. (reported by 2 sources)
- The campaign exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco Catalyst SD-WAN products. (reported by 2 sources)
- LittleFilch is designed to extract AES-256 encryption key material. (reported by 2 sources)
- The CVE-2026-20127 vulnerability has a CVSS score of 10.0. (reported by 1 source)
- The vulnerability may have been exploited as a zero-day starting in 2023. (reported by 1 source)
- KeyDrift consists of the PolyFlame backdoor and the LittleFilch data harvesting module. (reported by 1 source)
- Confirmed targets of the campaign include space, satellite, defense, and aerospace sectors. (reported by 1 source)
- Cisco released a patch for the authentication bypass in February 2026. (reported by 1 source)

## Timeline

### 2026-11-02: KeyDrift malware targets Cisco SD-WAN infrastructure

State-linked threat actor UAT-11473 used KeyDrift malware to exploit a critical Cisco SD-WAN vulnerability, potentially stealing encryption keys since 2023 to decrypt sensitive inter-site traffic.

3 sources. https://clstr.news/cluster/keydrift-malware-targets-cisco-sd-wan-encryption-keys

### 2026-10-30: Cisco Talos identifies KeyDrift malware targeting SD-WAN controllers

Cisco Talos reports that KeyDrift malware targets SD-WAN controllers to steal encryption keys, impacting defense, aerospace, and satellite sectors.

6 sources. https://clstr.news/cluster/cisco-talos-identifies-keydrift-malware-targeting-sd-wan-controllers

---
Cite as: KeyDrift malware targeting Cisco SD-WAN systems. CLSTR, https://clstr.news/situations/keydrift-malware-targeting-cisco-sd-wan-systems