KeyDrift Malware: Cisco SD-WAN Key Theft, What to Do - 2

Do it yourself · free Remove KeyDrift malware (Cisco SD-WAN controllers) yourself 5 steps, 15 minutes, no software needed.

KeyDrift malware (Cisco SD-WAN controllers): summary

Facts checked on 29 October 2026 against two news reports, from BleepingComputer and Cyber Security News, that describe Cisco Talos research published on 28 October 2026. We did not read the Talos report or the Cisco advisory, ran no test and infected no system; the steps for administrators follow the mitigation list in those reports and were not tried on a live controller.

What KeyDrift is, and what we know it

KeyDrift is the name of a malware framework, not of a website or a download. Cisco Talos published its research on 28 October 2026, and BleepingComputer and Cyber Security News wrote it on 29 October. We read those two reports; this page is built from them and says plainly where they stop.

1 What it is A custom framework built to run on Cisco Catalyst SD-WAN controllers. It works inside the processes that run the control side of the network, reads control messages after they have been decrypted, and collects the keys that protect traffic between sites. Talos says with high confidence that it was designed for long term access and for automated theft of keying material.

A custom framework built to run on Cisco Catalyst SD-WAN controllers. It works inside the processes that run the control side of the network, reads control messages after they have been decrypted, and collects the keys that protect traffic between sites. Talos says with high confidence that it was designed for long term access and for automated theft of keying material.

2 How it gets in Through CVE-2026-20127, an authentication bypass in Cisco Catalyst SD-WAN. It carries the top severity score of 10.0. A remote attacker can skip the login and be treated as a high privileged internal user. Cisco fixed the flaw in February 2026 and says there is no workaround, so installing the update is the only cure.

Through CVE-2026-20127, an authentication bypass in Cisco Catalyst SD-WAN. It carries the top severity score of 10.0. A remote attacker can skip the login and be treated as a high privileged internal user. Cisco fixed the flaw in February 2026 and says there is no workaround, so installing the update is the only cure.

3 Who used it Talos tracks the operators as UAT-11473, a newly identified group of the kind it calls an advanced persistent threat. The reported targets are space and satellite services, defense and aerospace technology, and policy research organizations.

Talos tracks the operators as UAT-11473, a newly identified group of the kind it calls an advanced persistent threat. The reported targets are space and satellite services, defense and aerospace technology, and policy research organizations.

4 What we could not confirm We found no figure for how many networks were hit, no date for when any intrusion happened, and no statement that stolen keys actually left a victim. Cyber Security News says Talos describes the activity as historical. We did not read the Talos report itself and we did not test anything.

What we could not confirm

We found no figure for how many networks were hit, no date for when any intrusion happened, and no statement that stolen keys actually left a victim. Cyber Security News says Talos describes the activity as historical. We did not read the Talos report itself and we did not test anything.

What KeyDrift malware (Cisco SD-WAN controllers) does on an infected PC

What we checked on 29 October 2026, and what we could not

KeyDrift has no web address to test. Our tool was given a name, not a domain, so there is no URLhaus record, no registration record and no plain request from our server. That is why this page has no site test and no screenshot. It rests on two published news reports.

Our check, 29 October 2026

URLhaus and registration data None. There is no reported URL for this name and no domain to look up. This is the normal state for a threat that lives on an appliance, and it says nothing safety.

Site test Not run. A plain request from our server only makes sense for an address, and there is none here.

Reports that agree BleepingComputer and Cyber Security News agree on the flaw, the group name, the targets and the two modules. They differ on how firmly Talos ties the group to Volt Typhoon (see the history section).

Primary report The Talos article is linked from both news reports, but we did not read it. Facts here come from the two news reports. Check Talos and the Cisco advisory before you act on a controller.

Severity of the flaw 10.0 out of 10, and a public proof of concept exploit is reported, according to Cyber Security News.

Serious for anyone who runs Cisco SD-WAN, no action for a device The rating comes from the reports, not from our own test. Nothing we found says KeyDrift affects ordinary computers or phones.

What happened, and when

The two reports give only a few dates, and the intrusion dates are missing. The timeline below contains only what they state, and the gaps are marked.

Since at least 2023 A different cluster uses the same flaw BleepingComputer says a cluster called UAT-8616 used CVE-2026-20127 as a zero day since at least 2023, and that recent research linked that exploitation to Volt Typhoon. This is a separate cluster from UAT-11473.

A different cluster uses the same flaw

BleepingComputer says a cluster called UAT-8616 used CVE-2026-20127 as a zero day since at least 2023, and that recent research linked that exploitation to Volt Typhoon. This is a separate cluster from UAT-11473.

February 2026 Cisco fixes the flaw Both reports say Cisco released the update for CVE-2026-20127 in February 2026. Cyber Security News lists the first fixed releases as 20.9.8.2, 20.12.6.1, 20.15.4.2 and 20.18.2.1, depending on the release train. Anything older than 20.9 has to move to a supported release.

Both reports say Cisco released the update for CVE-2026-20127 in February 2026. Cyber Security News lists the first fixed releases as 20.9.8.2, 20.12.6.1, 20.15.4.2 and 20.18.2.1, depending on the release train. Anything older than 20.9 has to move to a supported release.

Date not stated UAT-11473 deploys KeyDrift Talos observed the group using the flaw to install KeyDrift. Neither report says when. Cyber Security News says Talos calls the activity historical and does not say whether keys were sent out.

UAT-11473 deploys KeyDrift

Talos observed the group using the flaw to install KeyDrift. Neither report says when. Cyber Security News says Talos calls the activity historical and does not say whether keys were sent out.

28 October 2026 Cisco Talos publishes its research Talos names the group UAT-11473 and the framework KeyDrift, and describes the two modules PolyFlame and LittleFilch. It saw the authors still working on the code, with new anti debugging checks and different disguises for the process.

Cisco Talos publishes its research

Talos names the group UAT-11473 and the framework KeyDrift, and describes the two modules PolyFlame and LittleFilch. It saw the authors still working on the code, with new anti debugging checks and different disguises for the process.

29 October 2026 News coverage and a public exploit BleepingComputer and Cyber Security News report the research. Cyber Security News says researchers later published a public proof of concept exploit for the same bug, which raises the risk for controllers that are not patched. It also warns of a newer flaw, CVE-2026-20182, in the same vdaemon service that has been exploited.

News coverage and a public exploit

BleepingComputer and Cyber Security News report the research. Cyber Security News says researchers later published a public proof of concept exploit for the same bug, which raises the risk for controllers that are not patched. It also warns of a newer flaw, CVE-2026-20182, in the same vdaemon service that has been exploited.

Attribution is where the reports differ. BleepingComputer writes that Talos sees possible overlap with the Silent Train network of Volt Typhoon but made no definite link. Cyber Security News writes that Talos says with high confidence that the group's infrastructure overlaps heavily with Silent Train. We cannot settle this without the Talos text, so treat the link to Volt Typhoon as unconfirmed.

How KeyDrift works, step by step

The framework is made of a few pieces that hand work to each other. The names below are the ones Cyber Security News lists from the Talos research; BleepingComputer confirms PolyFlame, LittleFilch and the vdaemon target.

1 The login is skipped The attacker sends crafted requests that abuse the peering authentication of the SD-WAN system and is logged in as a high privileged internal user. This opens NETCONF access, which lets the attacker change the network configuration, and, according to BleepingComputer, add rogue peers.

The attacker sends crafted requests that abuse the peering authentication of the SD-WAN system and is logged in as a high privileged internal user. This opens NETCONF access, which lets the attacker change the network configuration, and, according to BleepingComputer, add rogue peers.

2 The malware makes itself start with the system The attacker edits the startup paths of the runit service manager, so that the malware launches along with normal services. The paths named in the report are /etc/sv/aaamgr/ for a malicious service and /etc/sv/sshd/ for a modified launcher.

The malware makes itself start with the system

The attacker edits the startup paths of the runit service manager, so that the malware launches along with normal services. The paths named in the report are /etc/sv/aaamgr/ for a malicious service and /etc/sv/sshd/ for a modified launcher.

3 An injector finds the target processes A script called conf_sshd looks for running vdaemon processes, the programs that handle the control connections. A tool called rsshd then pushes the main module, a library named libdssl.so, into each of them.

An injector finds the target processes

A script called conf_sshd looks for running vdaemon processes, the programs that handle the control connections. A tool called rsshd then pushes the main module, a library named libdssl.so, into each of them.

4 PolyFlame gives remote control PolyFlame lives in memory only. It runs commands through a TinyShell style component, reads and writes files, and relays traffic between the attacker's server and other infected machines. One variant is packed and pretends to be a legitimate service called aaamgr.

PolyFlame gives remote control

PolyFlame lives in memory only. It runs commands through a TinyShell style component, reads and writes files, and relays traffic between the attacker's server and other infected machines. One variant is packed and pretends to be a legitimate service called aaamgr.

5 LittleFilch takes the keys The module, a library named libcommon.so, hooks the SSL_read function inside vdaemon. That lets it see control messages after they are decrypted. For a preset list of edge routers it collects their IP addresses and a 32 byte field that Talos assesses is AES-256 key material for IPsec traffic between sites.

LittleFilch takes the keys

The module, a library named libcommon.so, hooks the SSL_read function inside vdaemon. That lets it see control messages after they are decrypted. For a preset list of edge routers it collects their IP addresses and a 32 byte field that Talos assesses is AES-256 key material for IPsec traffic between sites.

6 The data is locked and sent LittleFilch encrypts what it collected with RSA, saves it to /var/tmp/vdaemon.bin and can send it over UDP to an address read from a configuration file. It deletes that file after reading it, which removes one trace.

The data is locked and sent

LittleFilch encrypts what it collected with RSA, saves it to /var/tmp/vdaemon.bin and can send it over UDP to an address read from a configuration file. It deletes that file after reading it, which removes one trace.

The parts of KeyDrift in one table

The table collects the names the reports give. File names are the ones to look for on a controller; they are not names you would see on a normal computer.

What KeyDrift malware (Cisco SD-WAN controllers) can steal or download

What KeyDrift can take

It does not steal documents or passwords the way a typical stealer does. It goes for the secrets that hold a company network together, and for control of the machines that manage it.

Keys that protect traffic between sites

IP addresses of edge routers

Control session details

Commands run on the controller

Files read and written on the controller

Traffic relayed to other infected machines

Network configuration changed through NETCONF

What this can cost an organization

The consequences below follow from what the keys are used for. Where a line is our reading and not a quote, it says so.

High Traffic between sites may be readable Stolen IPsec key material is what protects traffic between company sites. Our reading: whoever holds those keys and can see the traffic could read it, which is why the reports call this espionage.

Traffic between sites may be readable

Stolen IPsec key material is what protects traffic between company sites. Our reading: whoever holds those keys and can see the traffic could read it, which is why the reports call this espionage.

High A hidden seat in the network core The controller decides how the network is built. A backdoor inside it, plus the power to add rogue peers, means the attacker can reshape the network.

A hidden seat in the network core

The controller decides how the network is built. A backdoor inside it, plus the power to add rogue peers, means the attacker can reshape the network.

High Long term presence Talos says the design aims at long term access. A controller that was patched later may still carry what was installed before the patch.

Talos says the design aims at long term access. A controller that was patched later may still carry what was installed before the patch.

Medium Keys stay useful until replaced Our reading: a key that was copied stays copied. Patching closes the door but does not make a stolen key safe again. The reports do not say how keys are replaced; Cisco has to answer that.

Keys stay useful until replaced

Our reading: a key that was copied stays copied. Patching closes the door but does not make a stolen key safe again. The reports do not say how keys are replaced; Cisco has to answer that.

Medium Other attackers use the public exploit Cyber Security News reports a public proof of concept. Unpatched controllers are open to anyone, not only to a state backed group.

Other attackers use the public exploit

Cyber Security News reports a public proof of concept. Unpatched controllers are open to anyone, not only to a state backed group.

Low Nothing, if you only saw the headline A network, a phone or a normal PC is not the target in any report we read.

Nothing, if you only saw the headline

A network, a phone or a normal PC is not the target in any report we read.

What an administrator may notice, and what not

The framework is built to stay inside memory and inside trusted processes, so a quiet controller proves nothing. The signs below come from the indicators in the reports.

How to check the PC for KeyDrift malware (Cisco SD-WAN controllers)

Who can meet KeyDrift

Almost nobody reading this page. KeyDrift was found on the control systems of Cisco SD-WAN networks, which belong to companies and institutions. Use the table to see where you stand.

How to check a Cisco SD-WAN controller

These checks are taken from the mitigation list that Cyber Security News gives and from the indicators in both reports. We did not run them on a live controller. Read Cisco's advisory and the Talos report first, and involve Cisco support, since a controller is a sensitive system.

1 Confirm the release Check that every Catalyst SD-WAN Controller, Manager and Validator runs a fixed build: 20.9.8.2, 20.12.6.1, 20.15.4.2 or 20.18.2.1, or a later one in your release train. Releases older than 20.9 must move to a supported release. The reports name no workaround.

Check that every Catalyst SD-WAN Controller, Manager and Validator runs a fixed build: 20.9.8.2, 20.12.6.1, 20.15.4.2 or 20.18.2.1, or a later one in your release train. Releases older than 20.9 must move to a supported release. The reports name no workaround.

2 Limit who can reach the controller As a stopgap, restrict ports 22 and 830 to known controller addresses. This reduces exposure but removes nothing that is already installed.

Limit who can reach the controller

As a stopgap, restrict ports 22 and 830 to known controller addresses. This reduces exposure but removes nothing that is already installed.

3 the authentication log In /var/log/auth.log, look for lines with Accepted publickey for vmanage-admin and check each source address. An address you cannot explain is a reason to escalate.

the authentication log

In /var/log/auth.log, look for lines with Accepted publickey for vmanage-admin and check each source address. An address you cannot explain is a reason to escalate.

4 Look for the named files and folders Look for /var/tmp/vdaemon.bin, /var/tmp/vdaemon.conf, /tmp/system-vdaemon, the folder /etc/sv/aaamgr/ and changes to /etc/sv/sshd/. A hit does not need to be one of all of them; the config file is deleted by design.

Look for the named files and folders

Look for /var/tmp/vdaemon.bin, /var/tmp/vdaemon.conf, /tmp/system-vdaemon, the folder /etc/sv/aaamgr/ and changes to /etc/sv/sshd/. A hit does not need to be one of all of them; the config file is deleted by design.

5 Turn on the detection rules Cyber Security News lists Snort 2 SIDs 67387 to 67416, Snort 3 SIDs 7:44 to 7:73, and SIDs 65938 and 65958 for the flaw. They only help when the traffic passes a sensor that you control.

Turn on the detection rules

Cyber Security News lists Snort 2 SIDs 67387 to 67416, Snort 3 SIDs 7:44 to 7:73, and SIDs 65938 and 65958 for the flaw. They only help when the traffic passes a sensor that you control.

6 Collect diagnostics before you call Run request admin-tech on each control component and keep the output, then open a Cisco TAC case. The output is needed for support to look at the system.

Collect diagnostics before you call

Run request admin-tech on each control component and keep the output, then open a Cisco TAC case. The output is needed for support to look at the system.

7 Remember the second flaw Cyber Security News warns of CVE-2026-20182, a newer flaw in the same vdaemon service that is already exploited. Read Cisco's advisory for it as well.

Remember the second flaw

Cyber Security News warns of CVE-2026-20182, a newer flaw in the same vdaemon service that is already exploited. Read Cisco's advisory for it as well.

8 A clean result is one data point KeyDrift keeps its main code in memory and removes its configuration. Finding nothing does not clear a controller that was exposed before patching.

A clean result is one data point

KeyDrift keeps its main code in memory and removes its configuration. Finding nothing does not clear a controller that was exposed before patching.

How to remove KeyDrift malware (Cisco SD-WAN controllers)

How to remove KeyDrift

A loader's job is to install other malware, so treat the PC as infected with more than one program until the scans are clean.

1 Step 1 : Delete scheduled tasks that bring it back Open Task Scheduler from the Start and click Task Scheduler Library . Select each task you do not recognise and read the Actions tab: a task that starts a file in %AppData% or %Temp% runs powershell with a long encoded line opens a web address belongs to KeyDrift or a similar program Right-click such a task and choose Delete , and check the subfolders too. Leave tasks from Microsoft, your PC's maker and programs you use. Task Scheduler is the same in Windows 11 and Windows 10. Full procedure with screenshots: Remove what malware leaves behind in Windows

Step 1 : Delete scheduled tasks that bring it back

Open Task Scheduler from the Start and click Task Scheduler Library . Select each task you do not recognise and read the Actions tab:

a task that starts a file in %AppData% or %Temp%

runs powershell with a long encoded line

opens a web address belongs to KeyDrift or a similar program

Right-click such a task and choose Delete , and check the subfolders too. Leave tasks from Microsoft, your PC's maker and programs you use. Task Scheduler is the same in Windows 11 and Windows 10.

Full procedure with screenshots: Remove what malware leaves behind in Windows

2 Step 2 : Remove it from startup Whatever KeyDrift installed usually starts with Windows. Open Task Manager with Ctrl + Shift + Esc , go to Startup apps in Windows 11 or the Startup tab in Windows 10, and disable what you do not know, starting with entries that have an empty Publisher column. Open file location on the right-click shows the file, which helps you decide and tells you what to delete later. Disabling is safe: if something you need stops working, switch it back on. Full procedure with screenshots: Stop apps from opening at startup On uGetFix

Step 2 : Remove it from startup

Whatever KeyDrift installed usually starts with Windows. Open Task Manager with Ctrl + Shift + Esc , go to Startup apps in Windows 11 or the Startup tab in Windows 10, and disable what you do not know, starting with entries that have an empty Publisher column.

Open file location on the right-click shows the file, which helps you decide and tells you what to delete later. Disabling is safe: if something you need stops working, switch it back on.

Full procedure with screenshots: Stop apps from opening at startup On uGetFix

3 Step 3 : Delete the folders left behind What the uninstaller leaves behind is usually in the user folders. Open File Explorer, switch on View > Show > Hidden items (in Windows 10 View > Hidden items ), and go through %LocalAppData% , %AppData% , %ProgramData% and the two Program Files folders. Sort by Date modified and delete folders that appeared together with the problem and belong to no program you use. Folders with random names that hold .exe , .dll , .js or .ps1 files are the strongest sign. Full procedure with screenshots: Remove what malware leaves behind in Windows

Step 3 : Delete the folders left behind

What the uninstaller leaves behind is usually in the user folders. Open File Explorer, switch on View > Show > Hidden items (in Windows 10 View > Hidden items ), and go through %LocalAppData% , %AppData% , %ProgramData% and the two Program Files folders.

Sort by Date modified and delete folders that appeared together with the problem and belong to no program you use. Folders with random names that hold .exe , .dll , .js or .ps1 files are the strongest sign.

Full procedure with screenshots: Remove what malware leaves behind in Windows

4 Step 4 : Scan the PC, then run the offline scan Open Windows Security > Virus & threat protection > Scan options , run a Full scan and remove everything it finds. Then select Microsoft Defender Antivirus (offline scan) and click Scan now : the PC restarts and scans before Windows loads, which finds files that hide while Windows runs. Save your work first, because the offline scan takes 15 minutes. Both scans are built into Windows 11 and Windows 10, and a second scanner from another vendor is a useful extra opinion. Full procedure with screenshots: Run a Microsoft Defender Offline scan

Step 4 : Scan the PC, then run the offline scan

Open Windows Security > Virus & threat protection > Scan options , run a Full scan and remove everything it finds. Then select Microsoft Defender Antivirus (offline scan) and click Scan now : the PC restarts and scans before Windows loads, which finds files that hide while Windows runs.

Save your work first, because the offline scan takes 15 minutes. Both scans are built into Windows 11 and Windows 10, and a second scanner from another vendor is a useful extra opinion.

Full procedure with screenshots: Run a Microsoft Defender Offline scan

5 Step 5 : Change passwords from another device and sign out other sessions Assume that the passwords saved in this PC's browsers, and the accounts that were open in them, are known to the attacker. From a phone or a clean computer, change the e-mail password first, then banking, shopping, social and gaming accounts. Use each service's option to sign out of all other sessions, because stolen cookies keep a session open even after a password change. Turn on two-step verification on each account. Wait with the infected Windows 11 or Windows 10 PC until the scans are clean. Full procedure with screenshots: Turn on two-step verification / secure a hacked account

Step 5 : Change passwords from another device and sign out other sessions

Assume that the passwords saved in this PC's browsers, and the accounts that were open in them, are known to the attacker. From a phone or a clean computer, change the e-mail password first, then banking, shopping, social and gaming accounts.

Use each service's option to sign out of all other sessions, because stolen cookies keep a session open even after a password change. Turn on two-step verification on each account. Wait with the infected Windows 11 or Windows 10 PC until the scans are clean.

Full procedure with screenshots: Turn on two-step verification / secure a hacked account

If you use a PC, a Mac, an iPhone or an Android phone

The reports describe KeyDrift only on Cisco SD-WAN controllers. We found nothing a version for personal devices.

Be careful with messages that use the news to sell you a cleaner or ask you to run a tool. Cisco publishes updates for its own products on its own site only. A program that claims to remove KeyDrift from a PC is not based on anything the reports say.

After removal: passwords, accounts and prevention

If a controller was reached: what to do

The reports do not give a cleanup procedure, and we did not find one. What follows is the order we would follow, built from the mitigation list and common sense, and marked as our reading where it goes beyond the sources. Cisco support decides the rest.

1 Do not wipe before you keep evidence Our reading: collect the admin-tech output and copies of the named files first, so Cisco and your incident team can see what happened. Then follow Cisco's instructions for the controller.

Do not wipe before you keep evidence

Our reading: collect the admin-tech output and copies of the named files first, so Cisco and your incident team can see what happened. Then follow Cisco's instructions for the controller.

2 Patch and restrict access Move to a fixed release and keep ports 22 and 830 limited to known addresses. This stops new entry through the flaw.

Patch and restrict access

Move to a fixed release and keep ports 22 and 830 limited to known addresses. This stops new entry through the flaw.

3 Assume the traffic keys were taken If a trace was found, treat the keys of the listed edge nodes as copied. Ask Cisco how keys are replaced on your setup, since the reports do not say.

Assume the traffic keys were taken

If a trace was found, treat the keys of the listed edge nodes as copied. Ask Cisco how keys are replaced on your setup, since the reports do not say.

4 Review peers and configuration Compare the current configuration and the list of peers to a known good copy. Remove peers that nobody approved.

Review peers and configuration

Compare the current configuration and the list of peers to a known good copy. Remove peers that nobody approved.

5 Rotate access Our reading: change the credentials and keys used for administration of the controllers, from a clean machine, once Cisco confirms the controller is clean.

Our reading: change the credentials and keys used for administration of the controllers, from a clean machine, once Cisco confirms the controller is clean.

6 Tell the right people Inform your security team, your management and, where the law requires it, the authority for your country or sector. Customers of a managed provider should be told too.

Tell the right people

Inform your security team, your management and, where the law requires it, the authority for your country or sector. Customers of a managed provider should be told too.

Keeping a network out of this kind of attack

The entry was a known flaw that had a fix in February 2026. The advice is short.

Apply Cisco security updates to the controllers as a priority, since the flaw has a public exploit.

Follow Cisco's hardening guide for Catalyst SD-WAN, which BleepingComputer names.

Limit management ports 22 and 830 to the addresses that need them.

Send authentication logs of the controllers to a place the attacker cannot reach.

Know which release each controller runs, and who is responsible for it.

Do not leave a management interface open to the internet.

Do not assume a patched system is clean if it was exposed before the patch.

Do not trust a quiet scan as proof of safety.

Do not run removal tools from unsolicited emails.

Questions KeyDrift malware (Cisco SD-WAN controllers)

What is KeyDrift malware?

KeyDrift is a custom malware framework that Cisco Talos found inside Cisco Catalyst SD-WAN controllers. It works in the processes that handle control traffic, reads messages after they are decrypted and collects the keys that protect traffic between sites.

It also acts as a backdoor. Talos published the research on 28 October 2026 and names the operators UAT-11473. It is not a program for ordinary computers.

Is KeyDrift a virus on my PC, Mac or phone?

No report we read says so. Both articles describe it only on the controller side of Cisco SD-WAN, which is network equipment run by companies.

If you have a normal PC, Mac, iPhone or Android phone, there is nothing to remove for this threat. Keep your devices updated, and treat any tool that claims to remove KeyDrift from a computer with suspicion.

How does KeyDrift get onto a controller?

Through CVE-2026-20127, an authentication bypass in Cisco Catalyst SD-WAN with a severity score of 10.0. A remote attacker can skip the login and be treated as a high privileged internal user.

Cisco fixed it in February 2026 and says there is no workaround. After entry, the attacker edits service startup paths and injects the backdoor module into vdaemon processes.

Who is behind KeyDrift and who was targeted?

Cisco Talos tracks the operators as UAT-11473, a newly identified advanced group. The reported targets are space and satellite services, defense and aerospace technology, and policy research organizations.

The link to Volt Typhoon is reported differently: BleepingComputer says possible overlap with the Silent Train network without a definite link, Cyber Security News says high confidence of heavy infrastructure overlap. Treat attribution as unsettled.

What does KeyDrift steal?

Mainly keys. Its LittleFilch module hooks SSL_read to see control messages after decryption, then collects IP identifiers and a 32 byte field that Talos assesses is AES-256 key material for IPsec traffic, for a preset list of edge routers.

It encrypts the data with RSA, saves it in /var/tmp/vdaemon.bin and can send it over UDP. The other module, PolyFlame, gives command execution and file transfer.

How do I know if my Cisco SD-WAN controller was hit?

Confirm the release first, then /var/log/auth.log for Accepted publickey for vmanage-admin from unknown addresses, and look for /var/tmp/vdaemon.bin, /var/tmp/vdaemon.conf, /tmp/system-vdaemon and the folders /etc/sv/aaamgr/ and /etc/sv/sshd/. Snort rules exist too.

KeyDrift lives mostly in memory and removes its configuration file after reading it, so finding nothing does not clear a controller that was exposed before patching. If you find a trace, collect diagnostics and Cisco support.

How do I remove KeyDrift?

We found no public removal procedure, and we will not invent one. The reports advise installing the fixed release, limiting ports 22 and 830 to known addresses, hunting for the listed traces, running request admin-tech on each control component and opening a Cisco TAC case.

If a trace is found, work with Cisco on cleanup and on replacing the keys that may have been copied.

Which Cisco releases fix the flaw?

Cyber Security News lists the first fixed releases as 20.9.8.2, 20.12.6.1, 20.15.4.2 and 20.18.2.1, depending on the release train, and says releases older than 20.9 must move to a supported release. The flaw affects Catalyst SD-WAN Controller and Manager, and the article also names the Validator. Check Cisco's advisory for the exact table for your version before you decide.

Is there a public exploit, and is there a second flaw?

Cyber Security News reports that researchers later published a public proof of concept exploit for CVE-2026-20127, which raises the risk for unpatched systems.

It also warns of CVE-2026-20182, a newer flaw in the same vdaemon service that has been exploited. We did not read those exploit pages. Read Cisco's advisories for both and patch both.

Will Fortect remove KeyDrift?

Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.

For KeyDrift, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.

Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.

Cisco Talos: Inside KeyDrift, analyzing historical UAT-11473 activity on Cisco SD-WAN (28 October 2026) ( read October 29, 2026 )

BleepingComputer: Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware (29 October 2026) ( read October 29, 2026 )

Cyber Security News: Hackers Exploit Critical Cisco SD-WAN 0-Day Flaw to Deploy KeyDrift Malware and Steal Encryption Keys (29 October 2026) ( read October 29, 2026 )