TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Cisco Talos reported on Oct. 28 that custom malware called KeyDrift targeted Cisco Catalyst SD-WAN control systems and collected encryption-key material. Talos says attackers exploited CVE-2026-20127, a flaw Cisco patched in February; the extent of any key theft and the number of affected organizations remain unknown.
Cisco Talos said on Oct. 28 that attackers used custom malware called KeyDrift on Cisco Catalyst SD-WAN control systems to collect material it assesses as encryption keys for traffic between company sites. The activity involved CVE-2026-20127, a critical flaw Cisco disclosed and patched in February; Talos has not said how many organizations were affected or whether the collected keys were taken off their networks.
Talos says a group it tracks as UAT-11473 exploited the vulnerability to install KeyDrift on SD-WAN control systems. One malware module reads decrypted control messages handled by the controller and extracts a 32-byte field that Talos assesses as AES-256 key material. The report describes a method for accessing keys inside the controller, rather than simply copying files from a victim’s network.
Cisco’s Feb. 25 advisory says CVE-2026-20127 affects the Catalyst SD-WAN Controller, Manager and Validator. Cisco described an authentication flaw that could let a reachable attacker gain access as a high-privileged internal account and change SD-WAN configuration using the NETCONF management protocol. The company rated the issue CVSS 10.0 and said there was no workaround. Cisco later added the Validator to the advisory on June 16.
Cisco said it was aware of limited exploitation, according to its advisory. Talos traced an earlier cluster of exploitation to at least 2023, but its Oct. 28 report calls the KeyDrift activity “historical” without giving its dates or victim count. Lumen’s Black Lotus Labs separately reported on the same day that the group it identifies as Volt Typhoon exploited the flaw by late 2025 and continued after disclosure. Talos said UAT-11473 infrastructure “overlaps considerably” with the Silent Train relay network; that overlap does not establish that UAT-11473 and Volt Typhoon are the same group.
Why Key Access Raises the Stakes
SD-WAN systems connect offices and route traffic across a company’s network, with encrypted tunnels helping protect communications between sites. A controller that handles those tunnels’ key material is a high-value target: access to it may offer a way to compromise network management and, if keys are copied and remain usable, potentially expose traffic protected by them. Talos reports key collection, but the report does not establish that attackers decrypted communications or retained usable keys.
The incident also shows why applying a software update is not, by itself, proof that a compromised system is clean. A patch addresses the vulnerability; it may not remove malware already installed or undo unauthorized configuration changes. Organizations that suspect an intrusion need to investigate the systems and credentials involved, not treat installation of the update as a complete response.
The broader exposure extends beyond one vendor. The source material cites Google’s count of 21 exploited zero-days in security and networking products during 2025 and says many edge devices do not run endpoint detection. It also cites Verizon’s finding that vulnerability exploitation was the most common initial access path in its breach data, at 31%. Those figures describe separate research and do not establish the scale of this Cisco incident.
Products Worth Considering
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
LG UltraGear 45GX900A-B 45-Inch Curved OLED Gaming Monitor
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
As an affiliate, we earn on qualifying purchases.
February Patch, October Malware Report
Cisco disclosed CVE-2026-20127 on Feb. 25, 2026, crediting Australia’s Australian Signals Directorate’s Australian Cyber Security Centre with reporting it. The flaw concerns peering authentication, which governs whether machines can join the SD-WAN control system. Cisco said the issue affected systems across configurations and deployment types, including on-premises and hosted environments, and provided software updates rather than a workaround.
On the disclosure date, the U.S. Cybersecurity and Infrastructure Security Agency issued Emergency Directive 26-03, ordering federal civilian agencies to inventory affected systems, collect evidence and apply updates within set deadlines. The source material also says agencies from the United States, Australia, Canada, New Zealand and the United Kingdom issued a joint alert warning that Cisco SD-WAN systems had been exploited for more than a year. Talos’s later KeyDrift report adds a specific account of malware aimed at collecting key material, while leaving the scope of that activity open.
“limited exploitation”
— Cisco, in its security advisory
Victim Scope and Key Exposure
Talos has not disclosed how many organizations were affected, when the KeyDrift activity took place, or whether key material left the compromised systems. The report’s assessment of a 32-byte field as AES-256 key material is not the same as confirmation that attackers used those keys to read network traffic. The material provided also does not establish whether any keys remained valid, were rotated, or were used to access other systems.
Attribution requires care. Lumen links Volt Typhoon to exploitation of the vulnerability, while Talos reports infrastructure overlap between UAT-11473 and Silent Train. The available reporting does not confirm that the actors are one group or that every described campaign used KeyDrift.
Investigation Beyond the Patch
Organizations running affected Cisco Catalyst SD-WAN products should check Cisco’s advisory and confirm that systems are on a fixed release. They should also review available logs and configuration history for signs of unauthorized access, and assess whether controller credentials or network keys need to be replaced. If a system may have been compromised, Cisco’s update alone should not be treated as evidence that malware or unauthorized access has been removed.
The source material points to guidance from CISA for federal agencies that includes rebuilding affected systems from clean images and issuing new administrative credentials. Whether a particular organization needs that response depends on its investigation and applicable guidance. Cisco, Talos and other investigators have not publicly supplied a full victim count or a complete account of key use; further advisories or incident disclosures may clarify the scope.
Key Questions
What is KeyDrift?
KeyDrift is custom malware that Cisco Talos says was placed on Cisco Catalyst SD-WAN control systems. Talos says a module reads decrypted controller messages and extracts a field it assesses as encryption-key material.
What vulnerability did attackers exploit?
The reported activity involved CVE-2026-20127, an authentication flaw in Cisco Catalyst SD-WAN products. Cisco disclosed and patched it on Feb. 25, 2026, and said there was no workaround.
Does the report confirm that attackers read company traffic?
No. Talos reported the collection of data it assesses as key material, but the available reporting does not confirm that attackers used the keys to decrypt traffic or that keys left affected networks.
Is KeyDrift attributed to Volt Typhoon?
The reporting does not confirm that. Lumen’s Black Lotus Labs says Volt Typhoon exploited the same flaw, while Talos describes infrastructure overlap between UAT-11473 and Silent Train. Talos does not say those actors are the same group.
Is applying Cisco’s patch enough?
The patch addresses the vulnerability but may not remove malware installed before the update. Organizations that suspect compromise should investigate affected systems and credentials and follow relevant Cisco and government guidance on rebuilding or other remediation.
Source: Thorsten Meyer AI
