Hackers Exploit Cisco SD-WAN Flaw to Deploy KeyDrift Malware

Hackers exploited a critical Cisco Catalyst SD-WAN flaw to plant custom malware inside systems controlling an organization's network. The malware, named KeyDrift, is designed to copy encryption keys between sites for later use. Cisco Talos describes the attacks as historical but does not specify when they occurred or whether any keys were sent. The vulnerability, tracked as CVE-2026-20127, carries a CVSS score of 10.0 and allows an unauthenticated remote attacker to bypass authentication and gain administrative privileges on SD-WAN control systems.

The group behind KeyDrift is tracked by Talos as UAT-11473 and has targeted space and satellite services, defense and aerospace technology, and policy research. Talos assesses with high confidence that the group's infrastructure overlaps considerably with Silent Train. Lumen stated that Volt Typhoon used the Silent Train network to hide its activity. CISA, the NSA, and the FBI identified Volt Typhoon as a Chinese state-sponsored cyber group in 2024. Lumen reported that Volt Typhoon was exploiting the flaw by late 2025 and continued to do so after Cisco disclosed it in February.

KeyDrift primarily starts via modified runit scripts used by Cisco SD-WAN devices to launch services. On a compromised Validator, a fake aaamgr service runs a packed loader that decrypts and executes PolyFlame. PolyFlame runs in memory inside vdaemon and can act as a backdoor or a relay for commands. There are signs of timestomping where the group copied timestamps and permissions of existing files onto its own. Cisco says it is aware of limited exploitation and there is no workaround available. Until customers can upgrade, on-premises systems can limit access to ports 22 and 830 to the IP addresses of known controllers.