State-linked group exploited critical Cisco SD‑WAN zero‑day to deploy KeyDrift

A state‑linked hacking group exploited a maximum‑severity zero‑day in Cisco SD‑WAN to compromise controllers and install a custom malware framework researchers call KeyDrift.

The vulnerability, tracked as CVE‑2026‑20127, has a CVSS score of 10.0. It allows a remote attacker to bypass authentication and obtain administrative privileges without a password.

KeyDrift is designed to run inside the control plane of Cisco SD‑WAN. It copies the cryptographic keys that protect traffic between sites and also provides a persistent backdoor into infected controllers.

Targets identified so far include organizations in space and satellite services, defense and aerospace, and policy research. Cisco Talos published a detailed analysis of the malware on October 28, 2026 and attributes the campaign to an advanced persistent threat tracked as UAT‑11473. Talos describes the activity as historical and did not disclose exact intrusion dates or whether exfiltrated keys were delivered to the attackers.

How the exploit and post‑compromise chain work

The flaw resides in peering authentication used by the Catalyst SD‑WAN Controller, Manager and Validator. An attacker can send specially crafted requests to log in as a highly privileged internal user, which grants access to NETCONF and the ability to modify network configuration.

Cisco states there is no workaround; patching is the only full remediation. A public proof‑of‑concept exploit became available after the vulnerability was disclosed, increasing the risk to unpatched systems.

Once inside, the attackers modify runit service paths and startup scripts so the malware launches alongside legitimate services. A script named conf_sshd locates running vdaemon processes, and an injector called rsshd injects the main malware module into those processes.

The injected in‑memory module called PolyFlame (observed as libdssl.so) functions as a backdoor. It runs only in memory, can execute commands, read and write files, and relay instructions to other compromised hosts. A packed variant masquerades as the legitimate aaamgr service and uses anti‑debugging techniques to evade analysis.

A second module, LittleFilch (observed as libcommon.so), is responsible for stealing keys. LittleFilch hooks the SSL_read function inside vdaemon and inspects control messages after they are decrypted.

For a configured list of edge routers, LittleFilch extracts IP addresses and a 32‑byte field Talos believes contains AES‑256 key material used for IPsec tunnels. The stolen material is encrypted with RSA, written to /var/tmp/vdaemon.bin, and can be transmitted via UDP to an address in a configuration file that is deleted after use.

Links to Volt Typhoon / Silent Train and recommended defensive actions

Talos reports a high‑confidence overlap between UAT‑11473 infrastructure and an access network known as “Silent Train,” which has been associated with Volt Typhoon. That actor has previously abused routers and other edge devices to create covert relay points.

Cisco released fixes for CVE‑2026‑20127 in February 2026. Confirm every SD‑WAN controller is running a patched build. The first patched releases are 20.9.8.2, 20.12.6.1, 20.15.4.2 and 20.18.2.1, depending on your release train. Versions older than 20.9 must be migrated to a supported release.

While upgrading, restrict access to management ports: limit ports 22 and 830 so only known controller addresses can connect. Note this mitigates exposure but does not remove malware already present on a system.

If you suspect earlier exposure, patching alone is insufficient. Check /var/log/auth.log for unexpected entries such as “Accepted publickey for vmanage-admin” from unknown IP addresses. Look for the artifacts and files listed in the indicators section below. Collect a tech support bundle by running request admin-tech on each control component before opening a Cisco TAC case.

Defenders should also monitor for exploitation of CVE‑2026‑20182, another SD‑WAN Controller vulnerability that leverages the same vdaemon service and was observed in the wild. For detailed guidance and updates, refer to the Cisco security advisory.

Indicators of compromise (IoCs)

Note: IP addresses and domains in public reporting may be intentionally defanged (for example, using “[.]”) to prevent accidental resolution or hyperlinking. Only re‑fange indicators within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stop incidents quickly. Integrate threat intelligence from 16K SOCs.