KeyDrift steals Cisco SD-WAN keys via a 2023 zero-day

Cisco Talos found a custom malware framework called KeyDrift running inside Catalyst SD-WAN controllers and copying the AES-256 keys those controllers hand out to encrypt traffic between sites. The implant hooks the controller’s own decryption routine, reads the control-plane messages once they are in the clear, and pulls out the key material as the controller distributes it to edge routers.

The way in is CVE-2026-20127, a CVSS 10.0 authentication bypass that Cisco patched in February 2026. An unauthenticated remote attacker can reach the Catalyst SD-WAN Controller and Manager, gain administrative privileges, and add rogue peers. On a Controller the attacker lands as a high-privileged internal account rather than root. Talos has tracked exploitation back to at least 2023 under the name UAT-8616, so the flaw was a zero-day for years before the fix.

What KeyDrift takes

In Cisco’s design each SD-WAN router periodically generates an AES key for its own traffic and sends it to the Controller (formerly vSmart), which relays it to the other routers. A process called vdaemon runs the encrypted control connections that carry those keys. KeyDrift’s interception module, LittleFilch, hooks SSL_read inside vdaemon and reads the control messages after they have been decrypted. For a preset list of edge routers it extracts their IP identifiers and a 32-byte field that Talos assesses to be the AES-256 IPsec data-plane key material. It RSA-encrypts what it collects, writes it to /var/tmp/vdaemon.bin, and can send it over UDP to an address stored in /var/tmp/vdaemon.conf, a settings file it deletes after reading. Talos could not recover that settings file, and it calls the activity historical without saying when it happened or whether any keys were actually sent.

The persistence and remote-control side is PolyFlame, which runs in memory inside vdaemon. It behaves as a TinyShell-style backdoor that runs commands and reads and writes files, or as a relay that forwards commands between a command server and other machines. The analyzed samples carried no hardcoded C2 address; PolyFlame is built to accept commands embedded in SD-WAN control traffic. Startup goes through modified runit scripts: the SSH service’s run script launches a loader, conf_sshd, before the real SSH server, conf_sshd writes vdaemon’s process IDs to /tmp/system-vdaemon, and an injector called rsshd pushes PolyFlame into each of those processes. On a compromised Validator (formerly vBond), a fake aaamgr service under /etc/sv/aaamgr/ runs a packed loader, aaamgrd, that decrypts and runs PolyFlame. Cisco’s real aaamgr is a Python package and does not normally run as a compiled service, so a compiled aaamgrd is itself a signal. The group also timestomps, copying the timestamps and permissions of existing files onto its own.

Who is doing it

Talos tracks the group as UAT-11473 and says its targets are space and satellite services, defense and aerospace technology, and policy research. The group’s infrastructure “overlaps considerably” with Silent Train, the name Lumen’s Black Lotus Labs uses for a network of hacked SOHO, IoT and business devices that Volt Typhoon has used to hide its activity. Talos links UAT-11473 to Volt Typhoon only through that overlap; it does not call them the same group, and it does not say how UAT-11473 relates to the earlier UAT-8616 cluster. CISA, the NSA and the FBI attributed Volt Typhoon to the Chinese state in 2024. Separately, Lumen said on October 28 that Volt Typhoon was exploiting CVE-2026-20127 by late 2025 and kept doing so after the February patch, though Lumen does not connect that to KeyDrift.

If you run these controllers

The flaw affects the Controller, Manager and Validator regardless of configuration, on-premises and in Cisco’s hosted cloud, including the Cisco Managed and FedRAMP environments. Cisco added the Validator to the advisory on June 16. There is no workaround. Patch to a fixed release; the pre-20.9, 20.11, 20.13, 20.14 and 20.16 trains have reached end of software maintenance, so for some deployments this is a train upgrade rather than a point release. Until you can upgrade, on-prem operators can restrict ports 22 and 830 to the IP addresses of known controllers and systems, which Cisco says held up in a test environment. Blocking the ports does not remove an implant already on the box, and Cisco’s February guide warns that exploits planted before an upgrade can remain in place.

Nothing in the guidance says whether upgrading evicts KeyDrift or whether exposed keys should be rotated, and the implant’s purpose is to copy data-plane key material. Treat the IPsec keys on any controller showing signs of compromise as exposed, not just the box itself.

To hunt, check /var/log/auth.log for Accepted publickey for vmanage-admin entries from unknown IPs, run request admin-tech on each control component, and rescan those files with the Check Bug Applicability feature on the Bug Search Tool for CSCws52722. On disk, the named artifacts are libdssl.so (PolyFlame), libcommon.so (LittleFilch), the fake /etc/sv/aaamgr/ service, aaamgrd, conf_sshd, rsshd, /tmp/system-vdaemon, /var/tmp/vdaemon.bin and /var/tmp/vdaemon.conf. Talos published Snort coverage on October 28, rules 67387 to 67416 for Snort 2 and 7:44 to 7:73 for Snort 3 for inbound KeyDrift C2, with 65938 and 65958 covering the CVE itself; the Snort 2 rules ship disabled, so Subscriber-set users have to turn them on. Talos released no file hashes, IPs or domains.

For US federal civilian agencies, CISA’s February 25 emergency directive already sets the bar for a confirmed root-account compromise: report to CISA, stand up fresh Manager, Controller and Validator instances from patched images, and migrate edge routers onto them. Since patching may not remove the implant, rebuilding from clean images is the safer posture for anyone who finds signs of KeyDrift, not only the agencies under that directive.