KeyDrift malware steals SD-WAN encryption keys via CVE-2026-20127
Original title: Cisco Talos Uncovers KeyDrift Malware Targeting SD-WAN Controllers to Steal Network Encryption Keys
UAT-11473 uses a CVSS 10.0 auth bypass on Cisco Catalyst SD-WAN to plant in-process key stealers; fixes exist but no workaround.
Cisco Talos says UAT-11473 deployed KeyDrift against Cisco Catalyst SD-WAN controllers, managers, and validators, embedding it in control-plane processes to keep access and extract encryption material. Crafted requests abuse CVE-2026-20127, an unauthenticated peering flaw that yields a highly privileged non-root account and NETCONF access. Lumen reports exploitation from late 2025 through after the February 2026 disclosure. Cisco has shipped fixes and says no workaround resolves the bug. Talos describes targeted key harvesting, not proven decryption of all previously captured traffic.
Unconfirmed: Talos has high confidence of infrastructure overlap with Volt Typhoon’s Silent Train network but says that does not prove the names are the same actor.
- CVE-2026-20127 is a CVSS 10.0 authentication bypass with no workaround.
- PolyFlame, loaded as libdssl.so, hooks socket calls inside vdaemon.
- LittleFilch hooks SSL_read and collects a 32-byte field assessed as AES-256 IPsec keying material.
- A second variant masquerades as aaamgrd and checks TracerPid before unpacking an RC4 payload.
- Observed sectors include space and satellite, defense and aerospace, and policy research.
Impact: Privileged controller access and theft of IPsec keying material
| Product | Affected |
|---|---|
| Cisco Catalyst SD-WAN Controller, Manager, and Validator | — |
- 1.Install the fixed release from Cisco’s advisory; no workaround exists.
- 2.Restrict controller access and review unauthorized vmanage-admin public-key logins in /var/log/auth.log.
- 3.Hunt altered runit launchers, unexpected libraries, suspicious aaamgrd binaries, and /var/tmp/vdaemon.bin.
- CVEs
- CVE-2026-20127
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1055 Process InjectionT1036 MasqueradingT1048 Exfiltration Over Alternative Protocol
- Vendors
- Cisco
- Products
- Cisco Catalyst SD-WAN ControllerCisco Catalyst SD-WAN ManagerCisco Catalyst SD-WAN Validator
- Threat actors
- UAT-11473Volt Typhoon
- Malware
- KeyDriftPolyFlameLittleFilch
- Organizations
- Cisco TalosLumen Black Lotus Labs
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-20127 | Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator | 10.0 | 89% | KEV | KEV |
From the original article
3 min read at gbhackers.com
UAT-11473, an advanced persistent threat actor deploying KeyDrift, a custom malware framework targeting Cisco Catalyst SD-WAN controllers. The framework embeds inside legitimate control-plane processes to maintain access, intercept decrypted communications, and extract sensitive network encryption material. Observed targets span space and satellite services, defense and aerospace technology, and policy research.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.