KeyDrift malware steals Cisco SD-WAN encryption keys

Cisco Talos described a piece of malware on October 28 built to copy the AES keys that encrypt traffic between sites on an SD-WAN control plane and store them for later. The malware, KeyDrift, reached that control plane through CVE-2026-20127, a CVSS 10.0 flaw that lets an unauthenticated remote attacker bypass authentication and take administrative control of the Catalyst SD-WAN Controller, Manager, and Validator. On a Controller the account the attacker logs into is a high-privileged internal one, not root. Cisco fixed the flaw in February. Talos calls the attacks historical and does not say when they happened or whether any keys ever left the network.

How the key theft works

Cisco’s traditional key exchange routes every key through the Controller. Each SD-WAN router periodically generates an AES key for its traffic and sends it to the Catalyst SD-WAN Controller (formerly vSmart), which passes the keys on to the other routers. A process on the Controller called vdaemon runs the encrypted control connections that carry them, so the Controller handles every key in the clear as it relays it.

That is where KeyDrift sits. On a compromised Controller, a component called LittleFilch (libcommon.so) hooks into vdaemon and reads control messages after they have been decrypted. For a preset list of edge routers it extracts each router’s IP address and a 32-byte field that Talos assesses is the AES-256 key material. It encrypts what it collects with RSA, writes it to /var/tmp/vdaemon.bin, and can send it over UDP to an address from a settings file, /var/tmp/vdaemon.conf, which it deletes after reading. Talos could not recover that settings file, so the exfiltration destination is unknown.

How it hides

KeyDrift mainly starts through modified runit scripts, the init scripts Cisco SD-WAN devices use to launch services. In one version the run script under etc/sv/sshd/ starts a loader, conf_sshd, before the real SSH server. conf_sshd writes vdaemon’s process IDs to /tmp/system-vdaemon, and an injector called rsshd injects KeyDrift’s main module, PolyFlame (libdssl.so), into each of those processes. PolyFlame runs in memory inside vdaemon. It acts as a TinyShell-like backdoor that runs commands and reads and writes files, or as a relay that forwards commands between its command server and other machines. It accepts commands carried inside SD-WAN control traffic, and the analyzed samples had no hardcoded server address, which keeps network indicators thin.

The Validator loader looks different. On a compromised Validator (formerly vBond), a fake aaamgr service under /etc/sv/aaamgr/ runs a packed loader, aaamgrd, that decrypts and runs PolyFlame. Cisco’s real aaamgr is a Python package and does not normally run as a compiled service, so a compiled aaamgrd is worth looking for. The group also timestomped, copying the timestamps and permissions of existing files onto its own.

Who

Talos tracks the group as UAT-11473 and says it has targeted space and satellite services, defense and aerospace technology, and policy research. Its infrastructure “overlaps considerably” with Silent Train, the name Lumen’s Black Lotus Labs uses for a network of hacked small-office, home-office, IoT, and business devices. Lumen says Volt Typhoon used that network to hide its activity, and CISA, the NSA, and the FBI called Volt Typhoon a Chinese state-sponsored group in 2024. Talos links UAT-11473 to Volt Typhoon only through the infrastructure overlap. It does not say they are the same group, and it does not say how UAT-11473 relates to UAT-8616, the exploitation cluster Talos reported with the February disclosure that goes back to at least 2023. Separately, Lumen said on October 28 that Volt Typhoon was exploiting CVE-2026-20127 by late 2025 and kept exploiting it after Cisco disclosed the flaw, without tying that activity to KeyDrift.

Patching and detection

CVE-2026-20127 affects the Controller, Manager (formerly vManage), and Validator regardless of configuration, on-premises and in Cisco’s hosted deployments including the Cisco Managed and FedRAMP environments. Cisco added the Validator to its advisory on June 16. There is no workaround. Releases earlier than 20.9 and the 20.11, 20.13, 20.14, and 20.16 trains have reached end of software maintenance, so those installs cannot patch in place and have to move to a supported train. Until they upgrade, on-premises customers can limit ports 22 and 830 to the IP addresses of known controllers and other known systems. Cisco says this held up in a test environment but wants customers to verify it in their own networks. Those restrictions are already in place for the hosted deployments. Blocking the ports does not remove malware already on a device.

For the flaw itself, check /var/log/auth.log for “Accepted publickey for vmanage-admin” entries from unknown IPs. Run request admin-tech on each control component before opening a Cisco TAC case, and rescan those admin-tech files with the Check Bug Applicability feature on the Bug Search Tool for bug CSCws52722. Talos shipped Snort coverage on October 28: rules 67387 through 67416 for Snort 2 and 7:44 through 7:73 for Snort 3 look for inbound KeyDrift command-and-control, and existing rules 65938 and 65958 cover the CVE. The Snort 2 KeyDrift rules ship disabled, so Subscriber rule set users have to turn them on. Talos published no file hashes, IPs, or domains, so the file names and paths above are most of what defenders have to hunt with.

Two things the Talos guidance does not settle. It does not say whether upgrading removes KeyDrift from a device that was already compromised, or whether keys should be rotated after a compromise, even though copying keys is the point of the malware. Cisco’s February remediation guide warns there could be “existing exploits which are still in place” from before an upgrade. CISA’s February 25 emergency directive, binding on US federal civilian agencies, treats a confirmed root account compromise as unrecoverable in place: report it to CISA, deploy fresh Manager, Controller, and Validator instances from patched images, and migrate edge routers to the new systems.