KeyDrift malware targets Cisco SD

Feeds.4Sysops •IT News • October 29, 2026

Cisco Catalyst SD-WAN controllers manage connections between an organization’s sites. Talos says attackers used a critical authentication flaw to plant KeyDrift, malware that can collect encryption key material from controller traffic. Separately, Lumen reports Volt Typhoon exploited the same flaw from late 2025, but has not linked that activity to KeyDrift. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

KeyDrift Malware Exploits Cisco SD-WAN Flaw CVE-2026-20127 Cisco Talos reported that the advanced persistent threat group UAT-11473 exploited a critical authentication bypass vulnerability (CVE-2026-20127) in Cisco SD-WAN Catalyst Controllers. This flaw, which has a CVSS score of 10.0, allows unauthorized remote access to administrative privileges. The group deployed a custom malware framework named KeyDrift, which is designed to collect sensitive encryption keys from control-plane traffic. The malware's components, PolyFlame and LittleFilch, enable persistent access and automated exfiltration of keying material. The attacks have targeted sectors including space and satellite services, defense, and policy research. Talos assesses with high confidence that UAT-11473's infrastructure overlaps with the Volt Typhoon's Silent Train network, although no direct link between the two groups has been established. The vulnerability was disclosed in February 2026, and exploitation has been linked to activities dating back to at least 2023. 12 sources 81

Extracted Entities

KeyDrift malware targets Cisco SD

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

CWE Weaknesses (1)

Malware (1)

Platforms (1)