News Vulnerabilities & Zero-Days

KeyDrift: Hackers Tied to Volt Typhoon's Network Stole Encryption Keys From Cisco SD-WAN Controllers via CVSS 10 Flaw

Cisco Talos says threat actor UAT-11473 exploited critical Cisco Catalyst SD-WAN flaw CVE-2026-20127 and planted KeyDrift malware to steal data-plane encryption keys. Talos assesses with high confidence that the attackers' infrastructure overlaps with Volt Typhoon's Silent Train relay network, which Lumen has now detailed.

Published
A train of linked glowing routers racing silently through a dark network landscape toward a central SD-WAN controller, where a hand extracts a golden encryption key.

Key takeaways

  • Cisco Talos says UAT-11473 exploited Cisco Catalyst SD-WAN flaw CVE-2026-20127 (CVSS 10) and deployed KeyDrift malware.
  • KeyDrift steals control-session metadata and data-plane keying material from SD-WAN controllers.
  • Talos assesses with high confidence that the attackers' infrastructure overlaps with Volt Typhoon's Silent Train network.
  • Lumen says Silent Train uses rotating chains of hacked routers and enterprise devices and has hit hundreds of victims over three years.
  • Cisco first disclosed the flaw on February 25, 2026 and reports limited exploitation; there is no workaround.

Hackers broke into Cisco SD-WAN controllers and quietly harvested the keys that protect enterprise network traffic, according to new research from Cisco Talos.

In an October 28, 2026 report, Talos said a "highly sophisticated" advanced persistent threat (APT) actor it tracks as UAT-11473 exploited CVE-2026-20127, an authentication bypass in Cisco Catalyst SD-WAN Controller, and deployed a custom malware framework called KeyDrift. Talos assesses with high confidence that UAT-11473's infrastructure "overlaps considerably with Volt Typhoon's 'Silent Train' covert access network."

What is CVE-2026-20127? #

Detail Value
Products Cisco Catalyst SD-WAN Controller (vSmart), Manager (vManage) and Validator (vBond)
Flaw Authentication bypass
CVSS v3.1 10.0 (Critical)
First published February 25, 2026
Exploitation Cisco says it is aware of "limited exploitation"
Workaround None; Cisco lists mitigations

Cisco updated its advisory on October 28 to point to the Talos research. Lumen's Black Lotus Labs lists Cisco Catalyst SD-WAN among the platforms in what it describes as at least four confirmed and one likely zero-day campaigns run through Silent Train, but Cisco's advisory does not use the term zero-day.

What does KeyDrift do? #

According to Talos, KeyDrift is built for long-term persistence and automated key theft:

  • it runs inside SD-WAN control-plane processes and can read decrypted control traffic
  • it extracts control-session metadata and data-plane keying material, including what Talos assesses is an AES-256 IPsec key distributed over the OMP protocol
  • a component called PolyFlame provides a backdoor for running commands and moving files, and relays traffic between infected peers
  • a component called LittleFilch hooks SSL reads to harvest keys for chosen edge devices
  • stolen data is encrypted and staged locally before being sent out over UDP

Talos says targets span space and satellite services, defense and aerospace technology, and policy research.

What is Silent Train? #

In a companion report, Lumen's Black Lotus Labs describes Silent Train as a covert relay network that Volt Typhoon, a Chinese state-sponsored group, uses for its most sensitive operations. Key findings:

  • it is built from rapidly rotating chains of hacked home routers, IoT devices and enterprise systems, with more than 27 device classes
  • sessions average about four hours, and chains can be assembled in under two minutes
  • it is reserved for exploitation, credential theft and data exfiltration
  • it targets centralized management and control-plane platforms, including Versa Director, N-able N-Central, Cisco Catalyst SD-WAN, VeloCloud Orchestrator and Quest KACE
  • Black Lotus Labs says it has notified hundreds of victims over three years, across government, telecom, defense, satellite communications and critical infrastructure

Why does this matter? #

SD-WAN controllers sit at the heart of enterprise networks. With data-plane keys, an attacker may be able to decrypt traffic between sites without touching the endpoints. Talos and Lumen both say the focus on management and control-plane systems gives attackers broad reach from a single foothold.

What should Cisco SD-WAN customers do? #

  1. Patch CVE-2026-20127. Move to a fixed release, such as 20.9.8.2, 20.12.6.1, 20.15.4.2 or 20.18.2.1, depending on your train. Some trains are end of maintenance and must migrate.
  2. Restrict management access. For on-prem deployments, Cisco recommends limiting ports 22 and 830 to known controllers and trusted IPs.
  3. Hunt for KeyDrift. Check controllers for the artifacts Talos lists, such as libdssl.so, /tmp/system-vdaemon, /var/tmp/vdaemon.conf and changes under /etc/sv/sshd/ and /etc/sv/aaamgr/, and deploy the published Snort signatures.
  4. Rotate keys if compromised. Assume data-plane keys are exposed on any affected controller and engage Cisco TAC.
  5. Harden all control planes. Apply Lumen's advice to keep admin interfaces off the internet and monitor them closely.

Sources

  1. Cisco Talos: UAT-11473 and the KeyDrift framework, Cisco Talos
  2. Cisco advisory: Catalyst SD-WAN Controller authentication bypass (CVE-2026-20127), Cisco
  3. Lumen Black Lotus Labs: Silent Train, Volt Typhoon's operational framework, Lumen
  4. Volt Typhoon targeted enterprise control planes via Silent Train relay network, Help Net Security

Questions this raises

What is KeyDrift?
KeyDrift is a custom malware framework that Cisco Talos found on Cisco Catalyst SD-WAN controllers. It runs inside control-plane processes, steals data-plane keying material and session metadata, and includes backdoor and relay components.
Is Volt Typhoon behind the Cisco SD-WAN attacks?
Talos tracks the actor as UAT-11473 and assesses with high confidence that its infrastructure overlaps considerably with Volt Typhoon's Silent Train network. That is an infrastructure link, not a formal government attribution.
Is CVE-2026-20127 patched?
Yes. Cisco first published fixes on February 25, 2026. There is no workaround, and some release trains are end of maintenance and need to migrate to a supported fixed release.
What is Silent Train?
It is a covert relay network described by Lumen's Black Lotus Labs, built from rotating chains of compromised home, IoT and enterprise devices, which Volt Typhoon uses for exploitation, credential theft and data exfiltration.

CiscoCyber EspionageVolt TyphoonNetwork SecurityCritical InfrastructureThreat IntelligenceMalware