KeyDrift Malware Quietly Siphoned SD-WAN Encryption Keys Through Cisco Backdoor
A critical flaw in Cisco's Catalyst SD-WAN infrastructure was exploited to plant sophisticated malware designed to steal the encryption keys protecting traffic across entire enterprise networks. Cisco Talos published its findings on October 28, though the attacks themselves are described only as "historical" with no indication of when they happened or whether stolen keys were actually exfiltrated.
The vulnerability, CVE-2026-20127, carries a CVSS score of 10.0. That is the maximum. It allows an unauthenticated attacker to bypass authentication entirely and obtain administrative privileges on SD-WAN control systems. Cisco patched it in February.
The malware toolkit Talos identified is called KeyDrift. It targets a specific and genuinely valuable prize: the AES-256 keys that Cisco's SD-WAN architecture uses to encrypt traffic between sites. In normal operation, edge routers periodically generate these keys and register them with the Catalyst SD-WAN Controller, which distributes them to other routers. A core process called vdaemon manages the encrypted control connections that carry this key material.
On a compromised Controller, a KeyDrift component named LittleFilch hooks directly into vdaemon, reading control messages after decryption. It pulls IP addresses and what Talos assesses as 32-byte AES-256 key material for a preconfigured list of edge routers, encrypts the haul with RSA, and writes it to disk. It can then ship the data via UDP to an address stored in a configuration file that it deletes immediately after reading. Talos was unable to recover that file, so the destination remains unknown.
Deployment of KeyDrift relies on modified runit scripts, the same scripts Cisco SD-WAN devices use to start their own services. In one variant, the SSH service startup script is altered to run a loader called conf_sshd before the legitimate SSH server starts. That loader records vdaemon's process IDs, and a tool called rsshd injects KeyDrift's main module, PolyFlame, into those processes.
PolyFlame lives entirely in memory inside vdaemon. It functions as both a backdoor capable of running commands and reading or writing files, and as a relay that forwards instructions between a command server and other machines. Notably, analyzed samples contained no hardcoded server address, making static detection harder. Commands are designed to blend into legitimate SD-WAN control traffic.
On compromised Validator nodes (formerly vBond), the attackers created a fake aaamgr service under /etc/sv/aaamgr/. Cisco's real aaamgr is a Python package. The attacker version is a compiled binary, which is an obvious tell if anyone is looking. The attackers also performed timestomping, copying timestamps and permissions from legitimate files onto their own to make them blend in.
Talos attributes the activity to a cluster it calls UAT-11473, which has previously targeted space and satellite companies, aerospace and defence technology, and policy research institutions. The group's infrastructure overlaps substantially with Silent Train, a network of compromised SOHO routers, IoT devices and small business equipment that Lumen's Black Lotus Labs has documented. Lumen links Silent Train to Volt Typhoon, the Chinese state-sponsored group identified by CISA, the NSA and the FBI in 2024. Talos acknowledges the infrastructure overlap but stops short of equating UAT-11473 with Volt Typhoon directly.
Separately, Lumen stated on October 28 that Volt Typhoon was actively exploiting CVE-2026-20127 by late 2025 and continued doing so even after Cisco disclosed the flaw in February. Lumen does not connect that activity to KeyDrift specifically.
The flaw affects Catalyst SD-WAN Controller, Manager, and Validator regardless of configuration. On-premises deployments are vulnerable, as are Cisco's hosted cloud SD-WAN environments including FedRAMP and Cisco Managed deployments.
Fixed release versions by train are as follows. Release trains earlier than 20.9, and the 20.11, 20.13, 20.14 and 20.16 trains, are end-of-maintenance and require migration. For supported trains: 20.9 requires 20.9.8.2; 20.12 requires 20.12.5.3 or 20.12.6.1; 20.15, 20.13 and 20.14 all require 20.15.4.2; 20.16 and 20.18 require 20.18.2.1.
For those who cannot patch immediately, Cisco suggests restricting access to ports 22 and 830 to known IP addresses. That mitigation was validated in a test environment, with Cisco appropriately noting that real-world results may vary. Critically, blocking ports does nothing to remove malware already installed.
Talos released Snort detection rules on October 28. Rules 67387 through 67416 cover Snort 2; rules 7:44 through 7:73 cover Snort 3. The Snort 2 rules ship disabled by default, so paid Snort Subscriber users need to enable them manually. Older rules 65938 and 65958 cover the underlying CVE.
To check for signs of exploitation, Cisco advises looking in /var/log/auth.log for Accepted publickey for vmanage-admin entries from unrecognised IP addresses. Before contacting Cisco's Technical Assistance Center, admins should run request admin-tech on each control component and cross-reference results using the Check Bug Applicability feature against bug CSCws52722.
What Talos does not clarify is whether patching removes an active KeyDrift infection or whether compromised encryption keys need to be rotated. Cisco's own February remediation guide explicitly warned that prior exploits might still be present after upgrading. That is a fairly significant gap in the advice.
US federal civilian agencies fall under CISA's February 25 emergency directive. If a root account compromise is confirmed, they must notify CISA, spin up fresh Manager, Controller and Validator instances from patched images, and migrate edge routers to the new infrastructure.
KeyDrift indicators to hunt for include modified run scripts under /etc/sv/sshd/, a fake /etc/sv/aaamgr/ directory on Validators, and files named aaamgrd, conf_sshd, rsshd, libdssl.so (PolyFlame), and libcommon.so (LittleFilch). Data staging locations are /tmp/system-vdaemon, /var/tmp/vdaemon.bin, and /var/tmp/vdaemon.conf. Talos did not release file hashes, IP addresses or domains alongside its report.