TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Cisco Talos reported on Oct. 28, 2026, that custom malware called KeyDrift targeted Cisco Catalyst SD-WAN control systems and extracted what Talos assesses was key material for encrypted traffic between company sites. The malware exploited a critical flaw Cisco patched in February, but the number of affected organizations and whether keys were taken or used remain unknown.
Cisco Talos said Oct. 28 that a custom malware tool it calls KeyDrift was used to target Cisco Catalyst SD-WAN control systems and extract data Talos assesses as encryption-key material. The malware exploited CVE-2026-20127, a critical authentication flaw Cisco disclosed and patched in February; Talos has not said how many organizations were affected or whether the keys were taken out of the targeted networks.
Talos attributes the KeyDrift activity to a group it tracks as UAT-11473. Its analysis says a malware module read decrypted control messages on an SD-WAN controller and extracted a 32-byte field that Talos assesses as AES-256 key material used to protect traffic between an organization’s sites. The report describes the malware’s capability, but does not establish that attackers successfully used any extracted keys to decrypt traffic.
CVE-2026-20127 affects Cisco Catalyst SD-WAN Controller, Manager and Validator products. Cisco said an attacker able to reach an affected system could send crafted requests, authenticate as a privileged internal account and use NETCONF to alter SD-WAN configuration. Cisco rated the flaw 10.0 out of 10, said there was no workaround and issued software updates on Feb. 25. Its advisory said it was aware of “limited exploitation.”
Talos said it had traced an earlier exploitation cluster to at least 2023, but described the KeyDrift activity as historical without specifying when it occurred. Separately, Lumen’s Black Lotus Labs said on Oct. 28 that Volt Typhoon exploited the same vulnerability by late 2025 and continued after Cisco disclosed it. Talos reported infrastructure overlap between UAT-11473 and Silent Train, a relay network Lumen associates with Volt Typhoon; Talos did not say the groups are the same.
Why SD-WAN Key Theft Matters
SD-WAN controllers coordinate connections between a company’s offices and help distribute the information routers need to establish encrypted tunnels. If an intruder gains access to a controller, that position can expose sensitive network configuration and, as Talos describes, potentially reveal key material after the controller has processed it. This is different from breaking the encryption itself: the reported method targets the system that handles keys.
The report does not confirm that encrypted traffic was decrypted, or that any specific organization’s data was accessed. But the potential consequences extend beyond a one-time theft of files. If a key is copied and remains valid, it could put traffic protected by that key at risk, depending on the affected system and the attacker’s access. Organizations cannot assume that installing an update alone removes an intrusion that may already be present.
The case also highlights the risk of internet-reachable network infrastructure. Cisco’s flaw affected systems regardless of configuration, according to the advisory, and had no workaround. For businesses relying on centrally managed branch networks, checking patch status, access logs and controller integrity is a direct operational concern—not only a software maintenance task.
Products Worth Considering
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
DJI Mic 3 Wireless Microphone System (2 Transmitters, 1 Receiver, Charging Case)
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
The Flaw and Response Timeline
Cisco disclosed CVE-2026-20127 on Feb. 25, 2026, and published updates for affected products. The advisory said the vulnerability was in peering authentication, which governs which machines can join the SD-WAN control system. Cisco later added the Validator product to its advisory on June 16 and linked Talos’s new analysis on Oct. 28. Cisco credited Australia’s Australian Signals Directorate’s Australian Cyber Security Centre with reporting the flaw.
On the disclosure date, the U.S. Cybersecurity and Infrastructure Security Agency issued Emergency Directive 26-03, requiring federal civilian agencies to inventory their Cisco SD-WAN systems, collect evidence and apply updates by set deadlines. A joint alert from agencies in the United States, Australia, Canada, New Zealand and the United Kingdom warned that Cisco SD-WAN systems had been exploited for more than a year. These actions show the vulnerability had drawn government attention before the KeyDrift analysis was published.
Talos’s earlier reporting identified exploitation evidence reaching back to 2023 and tracked that activity under a separate designation, UAT-8616. The source material says attackers in that earlier cluster downgraded software and exploited another vulnerability, CVE-2022-20775. That history is relevant to the risk of persistent access, but it does not by itself establish that the earlier activity and KeyDrift were carried out by the same operators.
““limited exploitation””
— Cisco
What the Report Leaves Open
Talos has not disclosed how many organizations were affected, the precise dates of the KeyDrift activity, or whether extracted key material was transmitted beyond compromised systems. Its report describes a module designed to capture a field assessed as encryption-key material, but the available account does not confirm that attackers used it to decrypt traffic or access particular business data.
The relationship between the groups also remains unresolved. Talos reported substantial infrastructure overlap between UAT-11473 and Silent Train, while Lumen separately attributed exploitation of the same flaw to Volt Typhoon. The reporting does not establish that UAT-11473, Silent Train and Volt Typhoon are one group, or explain whether their activity involved the same intrusions.
It is also unclear from the material provided whether any affected systems remain compromised or whether all organizations that applied Cisco’s updates had already been breached. Cisco’s statement about “limited exploitation” does not specify a victim count or define the scope of that activity.
Patch, Investigate and Rotate Credentials
Organizations using affected Cisco Catalyst SD-WAN products should confirm that the relevant software updates are installed and check whether the systems were exposed before patching. Because an upgrade does not by itself remove malware, administrators should review controller integrity, access records and configuration changes for signs of unauthorized activity, following Cisco and government guidance.
For systems suspected of compromise, the source material points to the remediation approach CISA required for U.S. federal agencies: rebuild from clean system images and replace administrative credentials. Security teams should also evaluate whether key material may have been exposed and take appropriate steps to invalidate or replace affected keys. The next public milestones would be any additional technical findings from Talos, Cisco or government agencies, including clearer information on victims, timing and whether the extracted material was used.
Key Questions
What is KeyDrift?
KeyDrift is the name Cisco Talos gave to custom malware found in its analysis of attacks on Cisco Catalyst SD-WAN control systems. Talos says one module read decrypted controller messages and extracted a field it assesses as encryption-key material.
What vulnerability did the malware exploit?
The reported attacks exploited CVE-2026-20127, a flaw in peering authentication affecting Cisco Catalyst SD-WAN Controller, Manager and Validator products. Cisco disclosed and patched it on Feb. 25, 2026, and rated it 10.0 out of 10.
Does the report confirm that company data was decrypted or stolen?
No. Talos reported malware capable of extracting key material, but the available findings do not confirm that attackers used the keys to decrypt traffic, which organizations were affected or whether data was taken.
Are UAT-11473 and Volt Typhoon the same group?
The reporting does not establish that. Talos described infrastructure overlap between UAT-11473 and Silent Train, while Lumen separately said Volt Typhoon exploited the vulnerability. Infrastructure overlap is not confirmation that the groups are identical.
What should organizations do if they use affected systems?
Confirm the Cisco updates are installed, investigate systems for signs of prior compromise and follow vendor and government guidance. If a controller is suspected to be compromised, the material recommends rebuilding from a clean image and replacing administrative credentials; teams should also assess whether keys need replacement.
Source: Thorsten Meyer AI
