Cisco Talos analysis published October 28, 2026; coverage October 29, 2026
KeyDrift: Talos Details Malware That Lives Inside Cisco SD-WAN Controllers and Steals the Keys to the Network
Cisco Talos reported on October 28 that a sophisticated actor it tracks as UAT-11473 exploited CVE-2026-20127, a maximum severity authentication bypass in Cisco Catalyst SD-WAN Controller instances patched in February 2026, to install a custom malware framework named KeyDrift. Observed targets span space and satellite services, defense and aerospace technology, and policy research organizations. Talos assesses with high confidence that the framework is built for long-term persistent access and automated exfiltration of sensitive keying material: it operates inside SD-WAN control-plane processes, intercepts decrypted control traffic, and extracts control-session metadata and data-plane keying material for staging or transmission in encrypted records. Its primary component, PolyFlame, is a memory-resident module injected into legitimate vdaemon processes through modified runit service scripts, providing a TinyShell-styled backdoor with command execution and file read and write, and an intermediate command-and-control mode that relays tasking to other peers over the control plane itself rather than a conventional external beacon. A second component, LittleFilch, hooks SSL_read inside vdaemon, inspects decrypted control-session buffers for predefined edge nodes, extracts a 32-byte field Talos assesses as AES-256 IPsec data-plane key material, RSA-encrypts the records to a staging file, and can send them out over UDP in records resembling DTLS application data. Talos assesses with high confidence that UAT-11473 operating infrastructure overlaps considerably with Volt Typhoon Silent Train covert access network, while making no definitive identification of the two as the same actor. Talos published MITRE ATT&CK mappings, Snort coverage, and indicators, and directs organizations to the Cisco patches for CVE-2026-20127, the Catalyst SD-WAN hardening guide, and incident response with Cisco TAC support if post-compromise signs appear.
Executives
The asset under attack here is not a server, it is the trust fabric of the wide area network itself: the controllers that tell every site how to reach every other site, and the encryption keys that protect traffic between them. Malware that copies those keys from inside the controller can outlast a patch, because the patch closes the door while the copied keys remain valid. For any organization running Catalyst SD-WAN, the question for leadership is whether anyone has looked for this activity, not only whether the February fix was applied.
CIO / CISO
Confirm every controller, manager and validator runs a fixed release for CVE-2026-20127, then hunt rather than assume: Talos describes persistence through modified runit service launchers for sshd and aaamgr, an injector that loads the PolyFlame module into vdaemon, and a staging file at /var/tmp/vdaemon.bin, all of which can be checked against a known-good baseline. Because LittleFilch targets data-plane key material for selected edge nodes, plan key rotation for any controller where compromise is plausible, and engage Cisco TAC early, as Talos recommends, rather than rebuilding in isolation.
Engineers
Work from the Talos component table: check the runit run scripts under the sshd and aaamgr service paths for added lines that remount the writable overlay and launch background scripts, look for an ELF binary where the legitimate aaamgr component should be a Python package, and review vdaemon process modules for the injected libraries Talos names. Apply the published Snort signatures, SIDs 67387 through 67416 for the artifacts and 65938 and 65958 for the vulnerability, and preserve images of suspect controllers before remediation.
Everyone (non-IT)
There is no action for individual users in this report, and no sign in the Talos analysis that end user accounts or passwords were the target. If your IT team schedules SD-WAN controller maintenance or asks sites to accept a brief network interruption, this key protection work is the reason.