KeyDrift malware used CVSS 10.0 Cisco SD-WAN flaw to steal router encryption keys

A maximum-severity flaw on the SD-WAN control plane

Cisco Talos disclosed on October 28 that attackers used a maximum-severity flaw in Cisco Catalyst SD-WAN, tracked as CVE-2026-20127, to plant custom malware called KeyDrift on the systems that run an organization's SD-WAN. According to dev.to's report, the flaw lets an unauthenticated remote attacker bypass authentication and gain administrative privileges on the Controller (formerly vSmart), Manager (formerly vManage) and Validator (formerly vBond), regardless of configuration. Both on-premises and Cisco-hosted deployments are exposed, including the Cisco Managed and FedRAMP environments. Cisco added the Validator to its advisory on June 16 and says it is aware of limited exploitation. The flaw was fixed in February, but Talos describes the KeyDrift attacks as historical and provides no dates, victim counts or confirmation that any keys left the network.

How KeyDrift harvests keys

In Cisco's SD-WAN design, each router periodically generates an AES key for its traffic and sends it to the Controller, which distributes it to other routers. Those keys travel over encrypted control connections handled by a Controller process named vdaemon, which makes vdaemon the ideal interception point. A KeyDrift component called LittleFilch hooks into that process and reads control messages after they are decrypted. For a preset list of edge routers it extracts IP addresses and a 32-byte field that Talos assesses is AES-256 key material. The data is encrypted with RSA and written to a file, and the malware can send it over UDP to an address held in a settings file it deletes after reading. Talos could not recover that file, so the destination of any stolen keys is unknown. The preset router list suggests selective collection rather than bulk theft.

Persistence, a backdoor and anti-forensics

KeyDrift mainly launches through modified runit service scripts. In one variant, the SSH startup script runs a loader named conf_sshd before the real SSH server; that loader records vdaemon process IDs, and an injector called rsshd then pushes the main module, PolyFlame, into each of those processes. PolyFlame lives entirely in memory inside vdaemon and can act as a TinyShell-style backdoor for running commands and reading or writing files, or as a relay forwarding commands between its control server and other machines. It receives commands embedded in ordinary SD-WAN control traffic, and the analyzed samples contain no hardcoded server address, leaving defenders with nothing simple to block. On Validators, a fake aaamgr service runs a packed loader, aaamgrd, which decrypts and launches PolyFlame. The operators also copied timestamps and permissions from legitimate files onto their own, a timestomping technique that weakens file-date evidence during an investigation.

Attribution points toward Volt Typhoon infrastructure

Talos tracks the operators as UAT-11473, a group that has targeted space and satellite services, defense and aerospace technology, and policy research. With high confidence, Talos ties the group's infrastructure to Silent Train, a network of compromised SOHO, IoT and business devices named by Lumen's Black Lotus Labs. Lumen has said Volt Typhoon — described by CISA, the NSA and the FBI in 2024 as a Chinese state-sponsored group — used that network for cover. The link to Volt Typhoon rests only on the infrastructure overlap, and Talos does not claim the two are the same group. Separately, Lumen reported on October 28 that Volt Typhoon was exploiting CVE-2026-20127 by late 2025 and continued after Cisco's February disclosure, though it does not connect that activity to KeyDrift.

Patches exist, cleanup is not guaranteed

There is no workaround. Cisco's first fixed releases are 20.9.8.2, 20.12.5.3 or 20.12.6.1, 20.15.4.2 and 20.18.2.1. Customers on trains older than 20.9, or on 20.11, 20.13, 20.14 and 20.16, are past end of software maintenance and face a train migration rather than a point update. As an interim measure, on-premises customers can restrict access to ports 22 and 830 so only known controllers and systems can reach them, though Cisco says effectiveness must be validated in each network and port blocking does not remove malware already on a device. Cisco's February remediation guidance also warned that exploits could already be in place from before an upgrade. Published indicators include modified scripts under etc/sv/sshd, the fake /etc/sv/aaamgr/ directory, the loaders conf_sshd and aaamgrd, the injector rsshd, the modules libdssl.so (PolyFlame) and libcommon.so (LittleFilch), and the process list /tmp/system-vdaemon.

Why it matters

A CVSS 10.0 unauthenticated flaw on an SD-WAN control plane is close to the worst enterprise exposure possible: one reachable endpoint hands an attacker administrative control over how traffic is routed and encrypted between sites. KeyDrift converts that access into the ability to collect the AES keys protecting inter-site traffic, so encryption cannot be assumed intact for any router whose keys passed through a compromised Controller, even after patching. Vendor guidance does not say whether upgrading removes the malware or whether keys should be replaced, and the attack dates, victim count and any confirmed exfiltration remain undisclosed. Organizations that ran exposed control systems before February should treat patching as a first step: hunt for the published indicators, validate port restrictions and assume previously exchanged keys may have been collected.