Cybersecurity

Hackers Exploit Cisco SD-WAN Flaw to Deploy KeyDrift Malware

A newly identified advanced persistent threat group is exploiting a high-severity authentication-bypass vulnerability in Cisco Catalyst SD-WAN Controllers to establish long-term persistence and steal cryptographic keys.

Radwan AbdulhadiEditor and technology writer

Published: October 30, 2026 · Updated: October 30, 2026 · 3 min read

Hackers Exploit Cisco SD-WAN Flaw to Deploy KeyDrift Malware — Image: BleepingComputer

APT Group Targets Cisco SD-WAN Controllers

A newly identified advanced persistent threat group tracked as UAT-11473 has been observed exploiting a critical authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers. According to a report by BleepingComputer, the threat actors are leveraging this vulnerability to deploy a custom malware framework known as KeyDrift, as detailed further by BleepingComputer.

The underlying security issue is tracked as CVE-2026-20127, a maximum-severity flaw that Cisco addressed with a software patch in February 2026. The vulnerability allows remote attackers to acquire privileged access to Catalyst SD-WAN Controller and Manager instances, enabling them to introduce rogue peers into the network environment.

Historical analysis shows that another cluster, UAT-8616, has exploited the vulnerability as a zero-day since at least 2023. Recent research has also connected its exploitation to the Chinese state-sponsored hacking collective known as Volt Typhoon.

Connection to Volt Typhoon and the Silent Train Framework

Researchers at Cisco Talos examined the activity and noted that the UAT-11473 threat cluster shows signs of overlapping with Volt Typhoon’s covert access network, although a definitive link has not been established. Lumen researchers released findings on the Silent Train framework, which helped Volt Typhoon evade detection while carrying out zero-day vulnerability attacks.

The observed attacks targeted a variety of high-value sectors, including space and satellite services, defense and aerospace technology, and policy research organizations. Across these targets, the threat actors deployed the KeyDrift framework, which is specifically engineered to operate directly on Cisco SD-WAN controller instances.

Anatomy of the KeyDrift Malware Framework

Cisco Talos stated with high confidence that the KeyDrift framework is built to facilitate long-term persistent access and automate the exfiltration of sensitive keying material. As explained Cisco Talos, the framework operates deep within SD-WAN control-plane processes to intercept decrypted control traffic, extract session metadata, and securely transmit collected data.

KeyDrift comprises two primary functional components that are actively under development: PolyFlame and LittleFilch. Security researchers have noted ongoing updates to these modules, including the addition of new anti-debugging mechanisms and varied process impersonation techniques.

PolyFlame and LittleFilch Capabilities

The PolyFlame component operates inside legitimate vdaemon processes by using modified service startup scripts alongside a dedicated deployment injector. It supports command execution through a TinyShell-inspired utility, handles file uploads and downloads, and acts as a communication relay between the attacker's command-and-control server and multiple network peers.

Meanwhile, LittleFilch functions as a control-session interception module. It hooks SSL_read to inspect control-plane messages after they undergo decryption inside the controller instance. For predefined edge nodes, LittleFilch isolates IP identifiers and a 32-byte field assessed to be AES-256 IPsec data-plane key material.

The harvested information is secured using RSA encryption, temporarily written to local storage at /var/tmp/vdaemon.bin, and subsequently transmitted over UDP protocols back to the malicious operators.

Mitigation and Recommendations

To counter these campaigns, Cisco strongly advises system administrators to promptly apply all available security updates designated for CVE-2026-20127. Organizations should also review and implement the vendor's dedicated hardening guides for their Catalyst SD-WAN deployments to minimize potential attack surfaces.