KeyDrift Malware Targets Cisco SD-WAN Controllers to Steal Network Encryption Keys

Cisco Talos has analysed KeyDrift, a custom malware framework built to run inside Cisco SD-WAN controller environments. Talos assesses with high confidence that it is designed to give attackers long-term access and to automatically steal sensitive keying material, the data used to protect traffic between network devices. Talos also assesses with high confidence that the infrastructure of the group behind it, tracked as UAT-11473, overlaps considerably with Volt Typhoon's "Silent Train" covert access network.

The framework has two main parts. The first, PolyFlame, lives in memory and is deployed through modified service paths. It is injected into legitimate running controller processes, and can also pose as a packed loader variant. Because it operates from inside normal controller activity rather than calling out like a typical endpoint implant, it can reach control traffic while blending in. The second part, LittleFilch, handles collection. It inspects decrypted control messages, extracts keying material for a list of predefined edge nodes, and stores the data locally in encrypted form ready to be sent out.

Talos says the intended purpose is collection from the SD-WAN control plane: staying resident on controllers, reading traffic, pulling out keys and staging or sending them in encrypted form. Variations seen across the modules and deployment methods suggest the framework is still being actively developed. This report covers only the opening of Talos's research, so it should be read as a summary of the key findings rather than the full analysis.