Cisco SD-WAN flaw exploited to plant KeyDrift key-stealing malware

· Cybersecurity · United States · China

Cisco Talos said an advanced persistent threat group it tracks as UAT-11473 exploited CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers that was fixed in February, to deploy a custom malware framework called KeyDrift. The malware copies the keys that encrypt traffic between sites and stores them for later use, giving attackers a path to decrypt or impersonate network traffic. Talos linked the activity to infrastructure overlapping Volt Typhoon's "Silent Train" network, which Lumen detailed. The case shows attackers targeting the control plane of enterprise networking gear rather than endpoints, and persisting on systems whose patches were already available.

Why it matters：Compromise of SD-WAN controllers gives intruders encryption keys and network-wide visibility, a foothold far more valuable than a single endpoint — and one that survives ordinary incident response.

Key points

  • CVE-2026-20127 is an authentication bypass fixed in February 2026
  • KeyDrift copies inter-site encryption keys for later use
  • Talos linked the infrastructure to Volt Typhoon's Silent Train network

Sources (original reporting)

More stories from this day