[REVISION HISTORY]
KeyDrift malware targeting Cisco SD-WAN systems
1 recorded revision of this situation.
What changed
2026-11-03 05:41 UTC → 2026-11-03 23:14 UTC ·
added
removed
Cisco Talos identified KeyDrift, an advanced malware framework designed to target Cisco Catalyst SD-WAN controllers. The malware embeds itself within legitimate control-plane processes to maintain persistent access, intercept decrypted communications, and extract sensitive network encryption keys. Researchers noted that the operating infrastructure for this threat actor shows substantial overlap with the Silent Train network associated with Volt Typhoon. Subsequent analysis by Lumen’s Black Lotus Labs and CERT-EU identified the malware, tracked as UAT-11473, as being used by a state-linked threat cluster to harvest AES-256 encryption keys. The framework exploited a maximum severity authentication bypass vulnerability, CVE-2026-20127. Evidence suggests this vulnerability was being exploited as a zero-day since 2023, prior to Cisco issuing a patch in February 2026. KeyDrift is utilizes two primary components: PolyFlame, a backdoor injected into the vdaemon process memory for persistent access, and LittleFilch, a module designed to copy harvest AES-256 encryption keys from the vdaemon process, which decrypted SD-WAN control traffic. This enables the passive retrospective decryption of traffic between an organization’s sites. Confirmed targets include defense and aerospace technology, space and satellite services, and policy research organizations. Experts warn that while patching the vulnerability is necessary, it does not mitigate the risk of traffic intercepted during the period of exposure, necessitating comprehensive key rotation.
Versions
- 2026-11-03 23:14 UTC KeyDrift malware targeting Cisco SD-WAN systems
- 2026-11-03 05:41 UTC KeyDrift malware targeting Cisco SD-WAN systems
Select a version to see what changed compared to the one before it.