KeyDrift Malware Exploits Cisco SD-WAN Flaw

• •KeyDrift malware exploits a critical Cisco SD-WAN vulnerability (CVE-2026-20127).
• •The malware targets sensitive keying information in space and defense sectors.
• •Cisco disclosed the flaw in February 2026, with active exploitation confirmed since at least 2023.

Cisco Talos has identified UAT-11473, an advanced persistent threat actor exploiting CVE-2026-20127, a critical authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller. This flaw allows unauthorized access to control systems, enabling the installation of KeyDrift malware, which collects sensitive keying information. The malware targets sectors including space, defense, and policy research, and operates by intercepting decrypted control traffic. KeyDrift's primary components, PolyFlame and LittleFilch, facilitate persistent access and automated exfiltration of keying material. Cisco disclosed the vulnerability on February 25, 2026, with a CVSS score of 10.0, and Talos tracks its exploitation back to at least 2023. The group behind KeyDrift has overlapping infrastructure with the Volt Typhoon threat actor, but Talos does not confirm they are the same entity. The malware's development appears ongoing, with variations in deployment mechanisms observed.