Talos details KeyDrift malware stealing Cisco SD-WAN encryption keys

Cisco Talos published analysis on 28 October 2026 of a custom malware framework, KeyDrift, that hides inside Cisco Catalyst SD-WAN controller processes and is built to copy the keys that encrypt traffic between sites. The intrusions used CVE-2026-20127, the CVSS 10.0 Catalyst SD-WAN authentication bypass Cisco patched in February 2026.

What KeyDrift does

Talos describes two components. LittleFilch hooks the controller's vdaemon process, reads decrypted control messages, and pulls out edge-router IP addresses plus a 32-byte field that Talos assesses with confidence to be AES-256 key material exchanged between the Controller and edge routers. It encrypts that data with RSA, writes it to a file, and can send it out over UDP. A second component, PolyFlame, works as a TinyShell-style backdoor or a traffic relay.

The design is the story: rather than brute-forcing encrypted inter-site traffic, the operator steals the keys at the one place they're handled in the clear — the SD-WAN controller — and keeps them for later decryption.

Exploitation status

The entry point, CVE-2026-20127, lets an unauthenticated remote attacker bypass authentication and gain administrative control of a Catalyst SD-WAN controller. Cisco fixed it in February; exposed, internet-reachable controllers remain the risk. Talos calls the KeyDrift activity historical and does not say when it occurred or whether any keys were actually exfiltrated.

Attribution — hedged

Talos tracks the KeyDrift operator as UAT-11473, with victims in space and satellite services, defense and aerospace, and policy research. It assesses with high confidence that the group's infrastructure overlaps considerably with Silent Train, the self-rebuilding relay network that Lumen's Black Lotus Labs attributes to Volt Typhoon — we covered Silent Train yesterday. Talos is careful: infrastructure overlap is not identity, and it does not call UAT-11473 and Volt Typhoon the same actor. Earlier exploitation of the same flaw is tracked separately as UAT-8616, going back to at least 2023.

Action checklist

1. Patch Catalyst SD-WAN controllers to a fixed train (for example 20.9.8.2, 20.15.4.2, 20.18.2.1) if you haven't since February — CVE-2026-20127 is the way in.
2. Blocking ports 22 and 830 is an interim containment step only; it does not remove KeyDrift from an already-compromised controller.
3. Treat any controller that was internet-exposed pre-patch as suspect. Audit vdaemon for injected hooks and review for unexpected outbound UDP.
4. Rotate inter-site encryption keys on any controller you can't rule out as clean — key theft is the whole point of this malware.
5. Pull IOCs from the Talos writeup; secondary coverage doesn't embed them in reusable form.

Context

This is the second report in two days tying CVE-2026-20127 to China-nexus edge-infrastructure operations — Black Lotus Labs listed it among Volt Typhoon's zero-days, and now Talos documents distinct malware on the same flaw. The through-line is the control plane: SD-WAN orchestrators, like VPN concentrators and management appliances, concentrate trust, and that makes them worth custom tooling. Patch the controllers you forgot were on the internet.