KeyDrift: How a Cisco SD-WAN Vulnerability Became an IPsec Key Theft Tool

Cisco Talos says a highly sophisticated threat actor, UAT-11473, broke into Cisco Catalyst SD-WAN controllers through CVE-2026-20127. It then installed a new malware framework that Talos calls KeyDrift. KeyDrift runs inside the controller’s own vdaemon process and copies key material that, Talos assesses, protects traffic between company sites.

CVE-2026-20127 is the CVSS 10.0 Cisco SD-WAN vulnerability that Cisco first disclosed on 25 February 2026. Talos published its KeyDrift analysis on 28 October 2026. On the same day, Lumen’s Black Lotus Labs said Volt Typhoon had exploited the same flaw.

If you run Catalyst SD-WAN Manager, Controller or Validator, patching is only half the job. KeyDrift hides inside legitimate processes, so the hunt at the end of this article matters as much as the upgrade.

What Did Talos Find on the Controllers?

Talos tracks UAT-11473 as an advanced persistent threat (APT) actor. Its observed targets span space and satellite services, defense and aerospace technology, and policy research. Talos calls the activity historical and names no victims.

KeyDrift has two main parts. PolyFlame is a memory-resident backdoor and relay. LittleFilch is a collection module that pulls key material out of decrypted control traffic. Talos assesses with high confidence that the framework is built for long-term access and automated theft of that key material.

Talos also saw differences between samples of the modules and the ways they were deployed. It reads that as a sign that the framework is still being developed.

How Did the Attackers Get Past the Login?

Cisco’s advisory says the peering authentication in Catalyst SD-WAN Controller, Manager and Validator is not working properly. A crafted request lets a remote attacker with no account log in as an internal, high-privileged user that is not root. From there the attacker can reach NETCONF and change the configuration of the whole SD-WAN fabric.

The flaw affects all three components regardless of configuration, both on premises and in Cisco-hosted SD-WAN cloud. Cisco says there are no workarounds. It credits the Australian Cyber Security Centre with reporting the flaw. Our CVE-2026-20127 vulnerability page keeps the full list of fixed releases.

Public exploit code has existed for months. On 30 October, a GitHub search for the CVE id returned nine repositories, the first created on 4 March 2026. One README describes faking the last message of the control-plane handshake with a self-signed certificate, so the server marks the peer as trusted.

Cisco’s security team says it is aware of limited exploitation. On 28 October, Cisco updated the advisory to version 2.1 and added a link to the Talos report. Talos does not describe the steps between the first access and the changes it found on the controllers.

How Does KeyDrift Hide Inside vdaemon?

KeyDrift does not run as a separate program that stands out in a process list. It anchors itself in runit, the service manager that starts the SD-WAN daemons. In one deployment, the attacker edited the sshd service’s run script and added two lines before the real sshd starts.

Those lines remount the /rootfs.rw overlay as executable and start a script called conf_sshd in the background. The script lists the running vdaemon processes and saves their IDs in /tmp/system-vdaemon. An injector called rsshd then uses ptrace to load PolyFlame, shipped as libdssl.so, into each vdaemon process.

On an affected Validator, formerly called vBond, Talos found a second loader. A malicious runit service under /etc/sv/aaamgr/ starts aaamgrd, a packed program that poses as Cisco’s aaamgr component. The real aaamgr is a Python package, not a compiled service, so the fake one stands out.

The aaamgrd loader decrypts an RC4-encrypted copy of PolyFlame and quits if a debugger is attached. Talos also found signs of timestomping, where file dates are copied from other files to hide changes.

What Can PolyFlame Do Once It Is In?

PolyFlame hooks the recvfrom call inside vdaemon, so it takes its orders inside normal SD-WAN control traffic. Talos recovered no hardcoded IP addresses, ports or domains from the samples. Before acting on a message, PolyFlame checks that it carries the MD5 hash of the device’s current date.

It works in two modes. As a backdoor modeled on TinyShell, it runs shell commands and reads or writes files. As an intermediate command and control (C2) node, it keeps one link to its operator and relays traffic to many other peers.

Living inside vdaemon gives PolyFlame access to everything that process holds. Talos lists DTLS session keys, the edge topology, Overlay Management Protocol (OMP) routes and policy tables.

How Does LittleFilch Steal the Site-to-Site Keys?

LittleFilch, shipped as libcommon.so, hooks SSL_read inside vdaemon. Each time vdaemon reads a decrypted control message, the hook checks its size, its first byte and three marker patterns. When they match, it copies an edge router’s public IP, its OMP system IP and a 32-byte key field.

Talos assesses that the 32-byte field is AES-256 IPsec key material distributed through OMP. In plain terms, it is the kind of key that encrypts traffic between branch sites. LittleFilch encrypts each record with RSA and writes it to /var/tmp/vdaemon.bin.

The module can send the records over UDP, shaped like DTLS 1.2 application data. It reads its endpoints from /var/tmp/vdaemon.conf and deletes that file after reading it. Talos could not recover the file and does not say where any records went.

Is UAT-11473 Volt Typhoon?

Talos assesses with high confidence that UAT-11473’s infrastructure overlaps considerably with Volt Typhoon’s Silent Train network. That is a statement about shared infrastructure. Talos does not say that the two names describe the same group.

Black Lotus Labs makes the more direct claim. It says Volt Typhoon was exploiting CVE-2026-20127 by late 2025, months before Cisco’s disclosure, and kept using it well afterwards. Our Volt Typhoon threat group profile explains who attributes the group and on what evidence.

Black Lotus Labs says it has tracked Silent Train since 2023. The network chains hacked home routers, IoT devices and enterprise systems into short relay paths, then cleans them up after each session. The team links its monitoring to at least four confirmed zero-day campaigns and one likely one.

Every campaign it describes hit a system that manages other systems:

• Quest KACE endpoint management, where Lumen assesses with moderate confidence that a zero-day was used and counts more than 30 victims.
• Versa Director, which Black Lotus Labs documented in mid-2024.
• N-central, through a chain of flaws later assigned CVE-2025-8875 and CVE-2025-8876.
• Cisco Catalyst SD-WAN, through CVE-2026-20127.
• VeloCloud Orchestrator, through the zero-day now tracked as CVE-2026-16812 in VeloCloud Orchestrator.

We covered the VeloCloud side in three exploited VeloCloud Orchestrator flaws in 88 days. For the 2024 government view of the group, read our analysis of CISA advisory AA24-038A.

The Blackhole data adds one older signal. On 5 March 2026, a Russian-language Telegram channel claimed that web shells had started arriving in bulk on its Cisco SD-WAN honeypot. We could not verify that claim. On 28 and 29 October, two Russian-language hacking forums reposted summaries of the Silent Train and KeyDrift research.

Why Do Attackers Want the Control Plane?

An SD-WAN controller decides how every branch connects, which routes it learns and which keys it uses. Black Lotus Labs makes the same point about Volt Typhoon’s targets. It says one compromised management platform gave the group the reach of a full intrusion, with no lateral movement.

Our article on DevOps security lessons from October 2026 attacks made a similar argument about firewall consoles and update systems. A system with standing authority over others is the real target. KeyDrift shows the network version: the attacker reads keys inside the process that manages them.

It also explains why the implant lives in vdaemon. PolyFlame takes its orders inside normal control traffic, so there is no ordinary beacon to an outside server for defenders to spot.

What Should You Check on Your SD-WAN Controllers?

Hunt in the same order as the attack. Start with how the attacker got in, then look for persistence, then for signs of key theft.

1. Check /var/log/auth.log for “Accepted publickey for vmanage-admin” from IP addresses that are not your configured System IPs. Cisco gives this check in its advisory.
2. Validate every control connection peering event, especially vmanage peers, by time, public IP, system IP and peer type.
3. Compare the run scripts under /etc/sv/sshd/ and /etc/sv/aaamgr/ with a known-good image. A compiled aaamgrd file is a strong warning sign.
4. Look for /tmp/system-vdaemon, /var/tmp/vdaemon.bin and /var/tmp/vdaemon.conf on every control component.
5. Check what each vdaemon process has loaded, and treat a libdssl.so you cannot explain as a finding.

Talos has published Snort rules. SIDs 65938 and 65958 cover the CVE, while 67387 to 67416 (Snort 2) and 7:44 to 7:73 (Snort 3) cover KeyDrift. If you find signs, Cisco advises collecting admin-tech output from each control component and opening a case with its support team.

How Do You Fix the Flaw and Recover?

Upgrade first. Cisco lists these first fixed releases:

• On 20.9, move to 20.9.8.2.
• On 20.12, move to 20.12.5.3 or 20.12.6.1.
• On 20.13, 20.14 or 20.15, move to 20.15.4.2.
• On 20.16 or 20.18, move to 20.18.2.1.
• On 20.11, move to 20.12.6.1, and on anything older than 20.9, migrate to a fixed release.

Cisco says several of those trains have reached end of software maintenance. Next, cut what can reach the controllers. For self-hosted deployments, Cisco’s interim advice is to allow ports 22 and 830 only from known controller IPs and other known hosts.

The Cisco Catalyst SD-WAN hardening guide goes further. It puts the transport interfaces in a DMZ behind a firewall and keeps VPN 512 management traffic in an isolated network. It also suggests admin access only through hardened jump hosts.

An upgrade does not remove an implant that is already running. CISA’s Emergency Directive 26-03 tells US agencies that find a root compromise to deploy fresh controllers from patched images and move edge routers to them. Other operators who find KeyDrift traces have good reason to do the same. Our Cisco SD-WAN exploitation incident page tracks the February campaign and the later KEV additions.

Cisco’s hardening guide says each device makes a new AES data-plane key on a timer, 24 hours by default. That limits how long a stolen key stays in use, but only after the implant is gone. Talos does not say whether Cisco’s pairwise key mode limits what LittleFilch can collect.

Finally, know which SD-WAN components face the internet. External Attack Surface Management from Brandefense scans your internet-facing assets within minutes, so an exposed SD-WAN Manager page shows up on your own list.