Hackers Exploit Critical Cisco SD-WAN 0-Day Flaw to Deploy KeyDrift Malware and Steal Encryption Keys

A state-linked hacking group used a maximum-severity Cisco SD-WAN zero-day flaw to break into network controllers and install a custom malware framework called KeyDrift.

The flaw is CVE-2026-20127. It carries a CVSS score of 10.0 and lets a remote attacker skip authentication and gain administrative rights without a password.

KeyDrift is built to sit quietly inside the control system of a Cisco SD-WAN network. It copies the keys that protect traffic between company sites, and it also works as a backdoor.

The targets named so far include space and satellite services, defense and aerospace companies, and policy research groups. Researchers from Cisco Talos identified the malware and published their findings on October 28, 2026.

Talos tracks the actor as UAT-11473 and calls it a highly sophisticated advanced persistent threat (APT) group. It describes the activity as historical. It does not say when the intrusions happened or whether any stolen keys were actually sent out.

Hackers Exploit Critical Cisco SD-WAN 0-Day Flaw

The flaw sits in the peering authentication of the Catalyst SD-WAN Controller, Manager and Validator. An attacker sends crafted requests and logs in as a high-privileged internal user, which opens the door to NETCONF and lets them change the network setup.

Cisco says no workaround exists, so patching is the only fix. Researchers later published a public proof-of-concept exploit for the same bug, which raised the risk for unpatched systems.

After getting in, the attackers edit the startup scripts, known as runit service paths, so the malware starts with normal services. A script named conf_sshd finds the running vdaemon processes, and a tool called rsshd injects the main module into each one.

That module is PolyFlame. It lives only in memory and acts as a backdoor that can run commands and read or write files. It can also relay orders to other infected machines. One variant pretends to be the legitimate aaamgr service and uses anti-debugging checks to hide.

The second module, LittleFilch, does the key theft. It hooks a function called SSL_read inside vdaemon and reads control messages after they are decrypted.

For a preset list of edge routers, it grabs IP addresses and a 32-byte field that Talos believes is AES-256 key material for IPsec traffic.

LittleFilch encrypts the haul with RSA, saves it to a file, and can send it out over UDP to an address in a config file that it deletes after reading.

Links to Volt Typhoon and How to Defend

Talos says with high confidence that UAT-11473’s infrastructure overlaps heavily with “Silent Train,” a covert access network linked to Volt Typhoon.

That group has a record of hijacking routers, and earlier reporting on Volt Typhoon targeting Cisco routers shows how it turns edge devices into hidden relay points.

Cisco fixed CVE-2026-20127 in February 2026, so the first step is to confirm every controller runs a patched build. The first fixed releases are 20.9.8.2, 20.12.6.1, 20.15.4.2 and 20.18.2.1, depending on your release train.

Versions older than 20.9 must move to a supported release. Until you upgrade, limit ports 22 and 830 to known controller addresses, but remember this does not remove malware that is already there.

Patching alone is not enough if you were exposed earlier. Check /var/log/auth.log for “Accepted publickey for vmanage-admin” entries from unknown IP addresses, and look for the files listed below.

Run “request admin-tech” on each control component before opening a Cisco TAC case. Defenders should also watch for a newer SD-WAN Controller flaw, CVE-2026-20182, which uses the same vdaemon service and was also exploited. For full guidance, see the Cisco security advisory.

Indicators of compromnise (IoCs):-

Type	Indicator	Description
CVE	CVE-2026-20127	Authentication bypass, CVSS 10.0
Threat actor	UAT-11473	APT group behind KeyDrift
Malware	KeyDrift	Custom framework
Module	PolyFlame (libdssl.so)	In-memory backdoor and relay
Module	LittleFilch (libcommon.so)	Key-stealing SSL_read hook
Injector	rsshd	Injects libdssl.so into vdaemon
Script	conf_sshd	Finds vdaemon PIDs and starts injection
Loader	aaamgrd	Packed PolyFlame variant posing as aaamgr
Path	/etc/sv/aaamgr/	Malicious service path
Path	/etc/sv/sshd/	Modified runit launcher path
File	/var/tmp/vdaemon.bin	RSA-encrypted stolen key data
File	/var/tmp/vdaemon.conf	Endpoint config, deleted after reading
File	/tmp/system-vdaemon	List of vdaemon PIDs
Log entry	Accepted publickey for vmanage-admin	Check in /var/log/auth.log for unknown IPs
Snort 2 SIDs	67387–67416	KeyDrift detection rules
Snort 3 SIDs	7:44–7:73	KeyDrift detection rules
Snort SIDs	65938, 65958	CVE-2026-20127 detection

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.