KeyDrift Cisco SD-WAN Malware Steals Decrypted Keys
State-sponsored threat actors are compromising critical enterprise network infrastructure. Specifically, operators tracking as UAT-11473 breached Cisco Catalyst SD-WAN controllers across strategic industries. Intruders deployed a sophisticated in-memory malware suite dubbed KeyDrift into active system processes. This espionage campaign compromised satellite operators, aerospace manufacturers, defense contractors, and geopolitical think tanks. Furthermore, the malware extracts cryptographic keys directly from decrypted control streams.
Exploiting CVE-2026-20127 for Initial Controller Access
The adversaries achieved initial access by weaponizing vulnerability CVE-2026-20127. This severe authentication flaw carries a maximum severity score of 10.0 under CVSS metrics. Specifically, unauthenticated remote attackers can seize full administrative privileges across vulnerable controllers. Although Cisco published security patches in February 2026, threat actors weaponized unpatched edge devices aggressively. Because no viable workaround exists, organizations must upgrade to remediated firmware immediately.
SD-WAN controllers govern connections across corporate branches, datacenters, and cloud fabrics. Consequently, controlling this central nexus grants attackers comprehensive authority over entire network topologies. Rather than targeting peripheral workstations, the authors of the KeyDrift Cisco SD-WAN malware embedded their tools into foundational routing daemons.
In-Memory Injection and In-Band Command Execution
The primary loader component, named PolyFlame, injects directly into the running vdaemon process. Once established in memory, the implant inspects active control sessions, routing policies, and cryptographic exchange records. Furthermore, operators can execute system commands, write files, and relay instructions across interconnected nodes.
Notably, forensic researchers identified zero hardcoded command-and-control server addresses. Instead, operators transmit tasking orders directly inside legitimate Cisco SD-WAN control traffic. As highlighted in the comprehensive Cisco Talos threat report on KeyDrift, this covert communication scheme blinds conventional network monitoring tools.
Cryptographic Key Interception via LittleFilch
A dedicated exfiltration module named LittleFilch intercepts decrypted traffic streams within vdaemon memory. Specifically, the script isolates 32-byte operational blocks matching AES-256 key material. The SD-WAN fabric relies on these exact IPsec keys to secure site-to-site tunnels. Subsequently, LittleFilch encrypts the harvested keys with RSA algorithms and stages the data for UDP exfiltration.
Stealth Mechanisms and Silent Train Infrastructure
To evade administrative detection, secondary variants masquerade as the authentic aaamgr authentication service. The loader conducts automated anti-debugging checks and decrypts its payload exclusively in memory. Additionally, operators modified service startup scripts to retain control across device reboots.
Forensic investigations revealed significant infrastructure overlaps between UAT-11473 and the Silent Train botnet. Moreover, research on the Silent Train network by Lumen Technologies links this operational framework to Volt Typhoon. This state-aligned cluster routes malicious packets through compromised small office routers and IoT devices. While investigators track UAT-11473 independently, Volt Typhoon targeted this exact Cisco vulnerability previously.
Ultimately, network engineers must isolate management interfaces from the public internet. Furthermore, administrators should audit system logs for rogue traffic and eliminate suspicious persistent service modifications immediately.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
