Hackers use Cisco SD-WAN flaw to deploy KeyDrift malware

A threat group tracked as UAT-11473 exploited CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy KeyDrift, a custom malware framework, Cisco Talos researchers reported. The researchers said the activity targeted space and satellite services, defense and aerospace technology, and policy research organizations.

Cisco patched CVE-2026-20127 in February 2026. The flaw can let remote attackers gain privileged access to Catalyst SD-WAN Controller and Manager and add rogue peers. The source says UAT-8616 had exploited the vulnerability as a zero-day since at least 2023. Cisco Talos said UAT-11473 appears to overlap with Volt Typhoon’s “Silent Train” covert access network, but it made no definitive link.

Talos assesses with high confidence that KeyDrift is designed for persistent access and automated theft of sensitive keying material. It operates inside SD-WAN control-plane processes and can inspect decrypted control traffic, collect session metadata and data-plane keys, and stage or transmit the data using encrypted records.

The framework has two components, PolyFlame and LittleFilch. PolyFlame runs inside legitimate vdaemon processes and supports command execution, file transfers, and relaying communications between an attacker’s command-and-control server and multiple peers. LittleFilch hooks SSL_read to inspect decrypted control-plane messages. For predefined edge nodes, it extracts IP identifiers and a 32-byte field that Talos assesses to be AES-256 IPsec data-plane key material. It protects collected information with RSA encryption, saves it to /var/tmp/vdaemon.bin, and sends it over UDP.

Cisco recommends applying the available security updates for CVE-2026-20127 and consulting its hardening guide for Catalyst SD-WAN deployments.