Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys

Cisco Talos has disclosed that attackers abused a maximum-severity Cisco Catalyst SD-WAN flaw, CVE-2026-20127 (CVSS 10.0), patched in February, to deploy a custom implant named KeyDrift on SD-WAN control infrastructure. The malware's LittleFilch component hooks into the vdaemon process on compromised Controllers to intercept and harvest the AES-256 encryption keys exchanged between SD-WAN routers, while its PolyFlame module provides TinyShell-style backdoor and relay functions. Talos attributes the campaign to a cluster it calls UAT-11473, whose infrastructure reportedly overlaps with the Silent Train network linked to the Chinese state-sponsored group Volt Typhoon, and notes separately that Lumen observed Volt Typhoon exploiting the same CVE from late 2025 onward. The vulnerability affects on-premises and cloud-hosted Catalyst SD-WAN Controller, Manager and Validator deployments; Cisco urges immediate upgrades to the listed fixed releases (e.g., 20.18.2.1, 20.15.4.2) since no workaround fully removes the risk, and warns that upgrading alone may not eliminate malware already planted on compromised devices.