Ing. Calogero Bono
Cisco Talos published an analysis of KeyDrift on October 28, a malware designed to run inside Cisco Catalyst SD-WAN controllers. Attackers get in by exploiting CVE-2026-20127, an authentication bypass flaw with a CVSS score of 10.0 that Cisco fixed in February. The goal of the malware is to copy the keys that encrypt traffic between an organization's sites. This matters to anyone running geographically distributed corporate networks, because the target is the brain of the network and not a single router.
A few terms before we get into the facts. SD-WAN is a software-managed wide area network that connects sites and branch offices. The Controller (formerly vSmart) distributes rules and keys, the Manager (vManage) administers everything, and the Validator (vBond) authenticates devices. NETCONF is a protocol for changing the configuration of network equipment. An APT is an advanced, persistent group of attackers, often linked to a state. An authentication bypass lets someone get in without knowing any password.
What happened with CVE-2026-20127
According to the official Cisco advisory, the problem lies in authentication between components, which does not work as it should. A remote, unauthenticated attacker can send specially crafted requests and gain administrative privileges. On a Controller, they can access the system as a high-privilege internal user, but not as root. From there they reach NETCONF and can modify the configuration of the entire SD-WAN network.
The flaw affects Controllers, Managers and Validators, regardless of configuration. On-premise installations are involved, as are cloud environments hosted by Cisco, including those managed by Cisco and the FedRAMP environment. According to The Hacker News, Cisco added the Validator to the advisory on June 16 and says it is aware of limited exploitation. There are no workarounds to the patch.
How does KeyDrift work inside the controller?
In the traditional key exchange mechanism, each router periodically generates an AES key for its own traffic and sends it to the Controller. The Controller then passes it on to the other routers. A process called vdaemon handles the encrypted control connections that carry these keys.
PolyFlame and LittleFilch
KeyDrift has two main components. PolyFlame runs in memory inside legitimate vdaemon processes. It can behave like a TinyShell-style backdoor, executing commands and reading or writing files, or act as a relay between the command server and other machines. The analyzed samples do not contain a server address hardcoded in the code.
LittleFilch hooks into vdaemon and reads control messages after decryption. For a predefined list of edge routers, it extracts IP addresses and a 32-byte field, which Talos believes is AES-256 key material for IPsec tunnels. It encrypts everything with RSA, writes it to /var/tmp/vdaemon.bin, and can send it via UDP to an address read from a settings file, which is deleted after use.
How it gets installed
According to Talos, KeyDrift mainly arrives through modified runit scripts, the ones Cisco devices use to start services. The SSH service script launches a loader called conf_sshd, and a tool called rsshd injects PolyFlame into vdaemon processes. On a compromised Validator, a fake aaamgr service appears instead. Attackers also use timestomping, meaning they copy dates and permissions from existing files onto their own.
Which versions are fixed?
Cisco lists the first fixed release for each line. The count of lines out of maintenance follows what The Hacker News reports.
- Earlier than 20.9 - migrate to a fixed release.
- 20.9 - 20.9.8.2.
- 20.11 - 20.12.6.1.
- 20.12 - 20.12.5.3 or 20.12.6.1.
- 20.13, 20.14 and 20.15 - 20.15.4.2.
- 20.16 and 20.18 - 20.18.2.1.
Releases earlier than 20.9 and the 20.11, 20.13, 20.14 and 20.16 lines have reached end of software maintenance. Anyone using them must move to a supported version.
In the meantime, those running an on-premise installation can restrict ports 22 and 830 with ACLs, firewall rules or security groups, allowing only the known IPs of controllers and necessary hosts. Cisco says the measure worked in a test environment, but advises verifying it on your own network. For Cisco-hosted cloud deployments, these protections are already active.
Who is behind the attacks?
Talos attributes KeyDrift to the group UAT-11473, which has targeted space and satellite services, defense and aerospace technology, and public policy research centers. According to BleepingComputer, the group appears to overlap with the covert access network called Silent Train, linked to Volt Typhoon, but Talos does not establish any firm connection.
According to The Hacker News, the overlap concerns infrastructure. Silent Train is the name Lumen's Black Lotus Labs uses for a network of compromised devices, including small office, home and IoT equipment. Lumen claims Volt Typhoon used it to hide its activities and exploited CVE-2026-20127 as early as late 2025, even after the February disclosure. However, Lumen does not link that activity to KeyDrift.
Limits to be aware of
Many things remain open. Talos describes the historical attacks but does not say when they happened or whether any keys were actually sent. The settings file containing the destination address has not been recovered. The report includes no file hashes, IP addresses or domains useful for hunting.
It is unclear how UAT-11473 relates to UAT-8616, the group mentioned in February. It is also unclear whether the update removes KeyDrift from an already compromised device, or whether the keys need to be replaced. Blocking ports, moreover, does not eliminate malware that is already present. Cisco warns that active compromises may exist before an update is applied.
What changes for those working in digital
If your company or your clients use Catalyst SD-WAN, the update is not enough as the only action. You need to check whether someone got in earlier. Cisco suggests reading /var/log/auth.log and looking for Accepted publickey entries for vmanage-admin from unknown IPs, comparing them with the System IPs shown in the Manager.
Every peering event in the logs must be validated manually. Check the time against maintenance windows, the public IP against your inventory, the peer's system IP and the peer type. Before opening a case with Cisco TAC, run the request admin-tech command on each control component.
For those who develop and manage servers, there is a broader lesson. Encryption keys are as valuable a target as passwords, and a system that distributes them must be isolated and monitored. If you want to refresh the principles, we cover them in our guide to the Signal protocol for end-to-end encryption. With managed hosting and servers with security updates, the patching issue shifts to whoever administers them, but it still needs to be checked case by case.
Our take
For us, the most serious point is not the malware but the time involved. According to Cisco Talos, exploitation goes back to at least 2023, and Lumen describes activity that continued after February. A published patch does not close the matter if someone has had administrative access for months. Many organizations treat the update as the end of the job, and here it is not.
The communication about what comes next also falls short. The guidance on what to do if a compromise is found is generic, and there is no clear answer on replacing keys. For small Italian businesses, which often rely on a network provider without seeing the logs, this is a real problem. We covered a similar risk scenario for SMEs in our piece on what automated offensive security means for Italian SMEs. Ask your provider for a written answer, not a reassurance.
Frequently asked questions
What is CVE-2026-20127?
It is an authentication bypass flaw in Cisco Catalyst SD-WAN, with a CVSS score of 10.0. It allows a remote, unauthenticated attacker to gain administrative privileges. Cisco fixed it in February.
What is KeyDrift?
It is a malware framework described by Cisco Talos, designed for SD-WAN controllers. It is used to maintain persistent access, intercept control traffic and copy encryption keys. It has two components, PolyFlame and LittleFilch.
Is there a workaround to the update?
No. Cisco states there are no workarounds. For on-premise installations there is a temporary mitigation, namely restricting ports 22 and 830 to known IPs, but it does not replace the patch.
How do I know if I have been compromised?
Check /var/log/auth.log for Accepted publickey entries for vmanage-admin from unknown IPs. Compare them with the System IPs in the Manager and validate every peering event. If you find signs, open a case with Cisco TAC after running request admin-tech.
Is the Cisco-hosted cloud safe?
Not entirely. Hosted cloud installations are among those affected by the flaw. Cisco does, however, state that port protections are already active for these.
What to check in the coming months on your SD-WAN network
In the coming months, it is worth following Talos updates on indicators of compromise and on the cleanup of devices already hit. Three practical actions.
- Check your release and move to a fixed, still supported version, starting from Cisco's table.
- Look for past traces in authentication logs and in the files Talos identifies, and keep the admin-tech files for TAC.
- Restrict ports 22 and 830 to known IPs and ask your provider whether key replacement has been planned. For outside support, you can find the services of the Meteora Web agency.
