Is your Cisco SD-WAN compromised? What KeyDrift looks for

Cisco Talos described the malware, called KeyDrift, on October 28.

It calls the attacks historical but doesn't say when they happened or whether any keys were sent out.However, the vulnerability known as CVE-2026-20127 enables an attacker without authentication credentials to break through the authentication process and obtain administrative privileges on Cisco Catalyst SD-WAN control systems.Once the controller is successfully breached, the KeyDrift component LittleFilch attaches itself to the vdaemon process and starts reading the control messages once they get decrypted.

It extracts from those messages IP addresses of edge routers and a 32-byte chunk of data that appears to be an AES-256 key, according to Talos researchers.The collected data gets encrypted by LittleFilch and saved to a file.

It is capable of sending the collected information via UDP to an address listed in the settings file; however, Talos was unable to recover it.

The PolyFlame module operates in-memory as a backdoor/relay.Talos tracks the group as UAT-11473.

It has targeted space and satellite services, defence and aerospace technology, and policy research.Its infrastructure overlaps considerably with Silent Train, a network of hacked devices that Lumen says Volt Typhoon used.

Talos links the two only through that overlap.

It doesn't say they're the same group.Separately, Lumen said Volt Typhoon was exploiting the flaw by late 2025.

Lumen doesn't tie that activity to KeyDrift.This defect is applicable to the Controller, Manager, and Validator both on-premises and in Cisco’s cloud-hosted instance.

Cisco states that a workaround isn't available.

The first fixes are released as 20.9.8.2 in the 20.9 line, 20.12.6.1 in 20.11 and 20.12, 20.15.4.2 in 20.13 to 20.15, and 20.18.2.1 in the 20.16 and 20.18 lines.

Versions prior to 20.9 need migration.Until the upgrade, restrict ports 22 and 830 to known controller IP addresses.

This does not address malware that may already be resident on the device.Review any changed SSH execution scripts, a spoofed aaamgr process on a validator, libdssl.so, or libcommon. so and /var/tmp/vdaemon.bin.