News Hackers exploit Cisco SD-WAN Flaw to deploy Custom KeyDrift Malware.

[Fixxx]

A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift. CVE-2026-20127 is a max-severity flaw that Cisco patched in February 2026, which allows remote attackers to gain privileged access to Catalyst SD-WAN Controller and Manager and add rogue peers. UAT-8616 has exploited the vulnerability as a zero-day since at least 2023, and recent research also linked its exploitation to the Chinese Volt Typhoon state-sponsored hacking group. According to Cisco Talos researchers who reported on the activity, the UAT-11473 threat cluster appears to overlap with Volt Typhoon’s "Silent Train" covert access network, but they made no definitive links. In a report Lumen released yesterday, researchers revealed that the Silent Train framework allowed Volt Typhoon to evade detection while conducting zero-day vulnerability attacks.

Deploying KeyDrift​

The attacks Cisco researchers observed targeted space and satellite services, defense and aerospace technology, and policy research organizations, using the KeyDrift malware, which is a custom malware framework designed to operate on Cisco SD-WAN controller instances.

"Talos assesses with high confidence that the framework is designed to provide long-term persistent access and automated exfiltration of sensitive keying material," explained Cisco Talos. "KeyDrift operates inside SD-WAN control-plane processes and is capable of intercepting decrypted control traffic, extracting control-session metadata and data-plane keying material, and staging or transmitting the collected material using encrypted records."​

KeyDrift has two primary components, PolyFlame and LittleFilch, for which Talos saw signs of ongoing development, including new anti-debugging mechanisms and varied process impersonation. PolyFlame runs inside legitimate vdaemon processes using modified service startup scripts and an injector for deployment. It supports command execution through a TinyShell-styled component, file uploads and downloads, and relaying communications between an attacker’s command-and-control (C2) server and multiple peers. LittleFilch is a control-session interception module that hooks SSL_read to inspect control-plane messages after they have been decrypted inside the controller. For predefined edge nodes, it extracts IP identifiers and a 32-byte field that Talos assesses to be AES-256 IPsec data-plane key material. It uses RSA encryption to protect the collected information, saves it to /var/tmp/vdaemon.bin, and then transmits it over UDP to the attackers. Talos believes with high confidence that KeyDrift is designed to maintain persistent access to Cisco SD-WAN controllers, intercept control-plane traffic, extract cryptographic keys, and securely stage or exfiltrate the stolen data. Cisco recommends that system administrators apply the available security updates for CVE-2026-20127 and also consult the vendor’s dedicated hardening guide for Catalyst SD-WAN deployments.