Cisco Talos has described a malware framework called KeyDrift that a threat group it tracks as UAT-11473 installed on Cisco Catalyst SD-WAN systems after exploiting CVE-2026-20127, an authentication bypass in the SD-WAN control systems. Talos says KeyDrift is built to give long-term access and to collect keying material automatically. It calls the activity historical, and neither Talos nor The Hacker News says when the intrusions happened or whether any keys actually left the networks. Talos reports targeting of space and satellite services, defense and aerospace technology, and policy research.
The Hacker News explains the mechanism. In Cisco’s traditional key exchange, each SD-WAN router generates a key for its traffic and sends it to the Controller (formerly vSmart), which passes keys on to other routers. KeyDrift’s LittleFilch component hooks the Controller’s vdaemon process, reads control messages after they are decrypted, and pulls out what Talos assesses to be AES-256 key material for a preset list of routers. It encrypts the data with RSA, stores it, and can send it by UDP to an address in a settings file that it deletes after reading. A second component, PolyFlame, runs inside vdaemon in memory as a backdoor or relay. On a compromised Validator (formerly vBond), a fake aaamgr service starts a packed loader.
Talos says UAT-11473’s infrastructure overlaps considerably with the “Silent Train” relay network that Lumen documented, which we covered in Volt Typhoon’s ‘Silent Train’ Hid Four Zero-Day Campaigns. The Hacker News stresses that Talos links UAT-11473 to Volt Typhoon only through that infrastructure overlap and does not say the two are the same group, or how UAT-11473 relates to UAT-8616, the cluster Talos reported in February.
How to check if you’re affected
Affected products are Cisco Catalyst SD-WAN Controller, Manager and Validator, regardless of configuration, including on-premises systems and Cisco’s hosted SD-WAN cloud deployments, according to The Hacker News’s summary of Cisco’s advisory. CVE-2026-20127 has no workaround.
- Check your release against the first fixed versions The Hacker News lists: 20.9.8.2 (20.9), 20.12.6.1 (20.11), 20.12.5.3 or 20.12.6.1 (20.12), 20.15.4.2 (20.13, 20.14, 20.15) and 20.18.2.1 (20.16, 20.18). Releases earlier than 20.9 should migrate to a fixed release. Confirm the table against Cisco’s advisory.
- On-premises customers who cannot upgrade yet can limit access to ports 22 and 830 to the IP addresses of known controllers and other known systems. Cisco says this worked in a test environment, and it does not remove malware already on a device.
- Hunt for KeyDrift on Controllers and Validators. The Hacker News lists these artefacts: a modified run script under
etc/sv/sshd/that startsconf_sshd, a/etc/sv/aaamgr/directory with a packedaaamgrdloader on a Validator, the filesrsshd,libdssl.soandlibcommon.so,/tmp/system-vdaemon, and/var/tmp/vdaemon.binand/var/tmp/vdaemon.conf. Talos publishes Snort rules for the exploit and for the malware. - Follow Cisco’s Catalyst SD-WAN hardening guide. If you find signs of compromise, start incident response and contact Cisco TAC. The Hacker News notes that Talos’s advice does not say whether upgrading removes KeyDrift from a device that was already compromised, or whether keys should be replaced; Cisco’s February remediation guide warns that exploits from before an upgrade may remain in place.
Sources
- Cisco Talos: Inside KeyDrift, analyzing historical UAT-11473 activity on Cisco SD-WAN
- Cisco Security Advisory cisco-sa-sdwan-rpa-EHchtZk
- Lumen Black Lotus Labs: Silent Train, Volt Typhoon’s operational framework
- The Hacker News: Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys