Cisco SD-WAN Flaw Used to Install Malware That Steals Network Encryption Keys

Cisco Talos has reported that attackers exploited a critical flaw in Cisco Catalyst SD-WAN, tracked as CVE-2026-20127, to install custom malware on the systems that control an organisation's SD-WAN network. The flaw has a severity score of 10.0 and lets an unauthenticated remote attacker bypass authentication and gain administrative privileges. Cisco fixed it in February. Talos described the attacks as historical, but did not say when they happened or whether any stolen keys were actually sent out.

The malware is called KeyDrift. One component, LittleFilch, hooks into a process on the SD-WAN Controller and reads control messages after they are decrypted. For a preset list of edge routers, it collects their IP addresses and a 32-byte field that Talos assesses is AES-256 key material used to encrypt traffic between sites. LittleFilch encrypts what it gathers, writes it to a file, and can send it over UDP to an address in a settings file. Talos could not recover that file.

Talos tracks the group behind KeyDrift as UAT-11473. It has targeted space and satellite services, defense and aerospace technology, and policy research. Talos assesses with high confidence that the group's infrastructure overlaps considerably with Silent Train, a network of compromised small-office, home-office, IoT and business devices. Lumen says Volt Typhoon used that network to hide its activity, and US agencies said in 2024 that Volt Typhoon is a Chinese state-sponsored group.