Cisco SD-WAN Flaw Exploited to Deploy Malware Designed to Steal Traffic Encryption Keys
Summary
Talos says attackers exploited CVE-2026-20127 in Cisco Catalyst SD-WAN to deploy KeyDrift, which reads AES-256 key material from decrypted controller traffic. Whether any keys were sent is unknown; Cisco provides fixes and detection guidance.
Key points
- Talos reports historical exploitation of CVE-2026-20127, a critical flaw that can let unauthenticated attackers gain administrative privileges on affected Catalyst SD-WAN control systems.
- KeyDrift's LittleFilch component hooks into vdaemon and reads decrypted control messages. Talos assesses that it extracts AES-256 key material passed between routers.
- KeyDrift encrypts collected data with RSA and can send it over UDP to an address in a settings file; Talos could not recover that file, and the report does not establish whether keys were sent.
- Modified runit scripts help load PolyFlame into vdaemon processes. PolyFlame can run commands, read and write files, or relay commands between systems.
- Talos links UAT-11473 to Volt Typhoon only through infrastructure overlap; it does not say they are the same group or establish UAT-11473's relationship to UAT-8616. Lumen separately reported Volt Typhoon exploitation of the flaw, without linking it to KeyDrift.
- The flaw affects Catalyst SD-WAN Controller, Manager, and Validator deployments, including hosted services. Cisco says there is no workaround and advises installing fixed releases; limiting ports 22 and 830 can be a temporary measure for on-premises customers but does not remove existing malware.
- Talos released Snort rules for inbound KeyDrift command-and-control connections. Cisco also recommends checking authentication logs for suspicious vmanage-admin access and beginning incident response if post-compromise signs are found.
Article Details
- Attack Vectors
- CVE-2026-20127 allows an unauthenticated remote attacker to bypass authentication and gain administrative privileges on affected Cisco Catalyst SD-WAN control systems.
- KeyDrift can be launched through modified runit scripts. One variant uses a modified SSH service script to start conf_sshd, which launches rsshd to inject PolyFlame into vdaemon processes.
- On a Validator, a fake aaamgr service runs the packed aaamgrd loader, which decrypts and runs PolyFlame.
- LittleFilch hooks into vdaemon and reads decrypted control messages to collect router IP addresses and field data that Talos assesses to be AES-256 key material.
- PolyFlame can run commands and read or write files, or relay commands between its command server and other machines. It accepts commands within SD-WAN control traffic.
- KeyDrift can encrypt collected data with RSA and send it over UDP to an address in a settings file; Talos could not recover that file.
- Commands used by the group copied timestamps and permissions from existing files onto its own files.
- Defensive Notes
- Install Cisco's fixed releases for CVE-2026-20127, follow the Catalyst SD-WAN hardening guide, and monitor for post-compromise activity.
- Until systems can be upgraded, on-premises customers can restrict access to ports 22 and 830 to known controllers and other known systems. Cisco says this worked in a test environment and advises customers to validate it in their own networks.
- Port restrictions do not remove malware already on a device. The article does not establish whether upgrading removes KeyDrift or whether encryption keys should be replaced.
- Check /var/log/auth.log for Accepted publickey for vmanage-admin entries from unknown IP addresses. Cisco also recommends running request admin-tech on each control component and rescanning the files with the Check Bug Applicability feature for CSCws52722.
- Talos released Snort rules 67387 through 67416 for Snort 2 and 7:44 through 7:73 for Snort 3 to detect inbound KeyDrift command-and-control connections. The Snort 2 rules are disabled by default for subscribers to the paid rule set.
- If post-compromise signs are found, begin incident response and contact Cisco's Technical Assistance Center for help. CISA's emergency directive requires US federal civilian agencies that find a root account compromise to report it to CISA, deploy fresh patched Manager, Controller, and Validator instances, and move edge routers to the new systems.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationOn a compromised Validator, the packed aaamgrd loader decrypts and runs PolyFlame.T1036.004 · Masquerade Task or ServiceA fake aaamgr service under /etc/sv/aaamgr/ runs aaamgrd, masquerading as the legitimate aaamgr component.T1048.003 · Exfiltration Over Unencrypted Non-C2 ProtocolKeyDrift can send RSA-encrypted collected data over UDP to an address stored in a settings file.T1055 · Process InjectionThe rsshd tool injects KeyDrift's PolyFlame module into vdaemon processes.T1070.006 · TimestompThe article reports timestomping: commands copied existing files' timestamps and permissions onto the group's files.T1190 · Exploit Public-Facing ApplicationThe article says CVE-2026-20127 lets an unauthenticated remote attacker bypass authentication and gain administrative privileges on affected SD-WAN control systems.
CVE
Threat Actors
UAT-11473Talos tracks the group behind KeyDrift as UAT-11473 and says it has targeted space and satellite services, defense and aerospace technology, and policy research.UAT-8616Talos tracked exploitation of CVE-2026-20127 as UAT-8616, a cluster of activity it said went back to at least 2023. The article does not establish how this cluster relates to UAT-11473.Volt TyphoonLumen said Volt Typhoon exploited CVE-2026-20127 by late 2025 and continued after Cisco disclosed the flaw; Lumen did not link that activity to KeyDrift. Lumen also said Volt Typhoon used the Silent Train network to hide activity. CISA, the NSA, and the FBI described Volt Typhoon as a Chinese state-sponsored cyber group. Talos links UAT-11473 to Volt Typhoon only through infrastructure overlap and does not say they are the same group.
Malware
aaamgrdcompromised Validator, formerly vBond, a fake aaamgr service under /etc/sv/aaamgr/ runs a packed loader, aaamgrd, that decrypts and runs PolyFlame. Cisco's real aaamgr component is a Python package and does notKeyDriftThe malware, called KeyDrift, is designed to copy the keys that encrypt traffic between sites and store them for later use, Cisco Talos said on October 28. Talos calls the attacks historical but does not specify whenLittleFilchOn a compromised Controller, a KeyDrift component called LittleFilch hooks into vdaemon and reads control messages after they are decrypted. For a preset list of edge routers, it pulls out their IP addresses and aPolyFlamescript writes vdaemon's process IDs to a file, and a tool called rsshd injects KeyDrift's main module, PolyFlame, into each of those processes.
Vendors
Products
Tools
rsshdthe real SSH server. The conf_sshd script writes vdaemon's process IDs to a file, and a tool called rsshd injects KeyDrift's main module, PolyFlame, into each of those processes.SnortTalos released Snort rules on October 28 that look for inbound KeyDrift command-and-control connections: 67387 through 67416 for Snort 2, and 7:44 through 7:73 for Snort 3. Rules 65938 and 65958, already available,
Countries
Industries
defense and aerospace technologyThe group behind KeyDrift, which Talos tracks as UAT-11473, has targeted space and satellite services, defense and aerospace technology, and policy research.Policy researchThe group behind KeyDrift, which Talos tracks as UAT-11473, has targeted space and satellite services, defense and aerospace technology, and policy research.space and satellite servicesThe group behind KeyDrift, which Talos tracks as UAT-11473, has targeted space and satellite services, defense and aerospace technology, and policy research.