Hackers Exploit Cisco SD-WAN Vulnerability to Deploy Custom KeyDrift Malware

Overview of Cisco SD-WAN Exploitation

Security researchers have reported that an advanced persistent threat (APT) group tracked as UAT-11473 has been exploiting a maximum-severity authentication-bypass vulnerability in Cisco Catalyst SD-WAN Controllers. The security flaw, designated as CVE-2026-20127, allows remote attackers to secure privileged access to affected controllers and managers, enabling them to add rogue peers.

According to findings published by Cisco Talos and Lumen, historical exploitation linked to this vulnerability dates back to at least 2023. Reports indicate potential overlaps between the activity and the state-sponsored hacking group known as Volt Typhoon, specifically regarding a covert access network framework referred to as "Silent Train."

Targeted Sectors and KeyDrift Malware

Observations from security analysts indicate that the campaign targeted specific high-profile sectors, including:

• Space and satellite services
• Defense and aerospace technology
• Policy research organizations

To maintain operations within compromised environments, attackers deployed a custom malware framework named KeyDrift. Cisco Talos assesses with high confidence that KeyDrift is engineered for long-term persistence and automated data exfiltration.

Core Components of KeyDrift

The malware framework primarily consists of two components:

• PolyFlame: Operates within legitimate `vdaemon` processes using modified service startup scripts. It facilitates command execution, file management, and communications relay between command-and-control (C2) servers and peers.
• LittleFilch: Intercepts control sessions by hooking `SSL_read` to inspect decrypted control-plane traffic. It targets cryptographic material, such as AES-256 IPsec data-plane keys, encrypts the stolen data via RSA, and stages it locally before transmission over UDP.

Mitigation and Verification

Cisco has urged system administrators to apply the official security updates released for CVE-2026-20127. Additionally, organizations managing Cisco Catalyst SD-WAN infrastructure are advised to consult official vendor guidance and hardening documentation to verify system integrity and protect control planes from unauthorized access.