TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Cisco Talos reported on Oct. 28, 2026, that custom malware called KeyDrift was used on Cisco Catalyst SD-WAN systems to extract encryption key material. The activity involved CVE-2026-20127, a critical flaw Cisco patched in February; Talos has not disclosed how many organizations were affected or whether attackers took keys away from compromised networks.
Cisco Talos said on Oct. 28 that a custom malware family it calls KeyDrift was used to target Cisco Catalyst SD-WAN control systems and extract data Talos assesses to be encryption key material. The activity exploited CVE-2026-20127, a critical vulnerability Cisco disclosed and patched in February; the number of affected organizations and whether any keys were removed from their networks are not known.
Talos attributes the KeyDrift activity to a group it tracks as UAT-11473. Its analysis describes a malware component that reads decrypted control messages on an SD-WAN controller and extracts a 32-byte field that Talos assesses as key material for AES-256 encryption of traffic between company sites. This is Talos’s technical assessment; the report summary does not establish that attackers successfully used copied keys to decrypt traffic.
The vulnerability affects Cisco Catalyst SD-WAN Controller, Manager and Validator products, according to Cisco’s advisory. Cisco said a remote attacker able to reach an affected system could exploit the flaw in peering authentication to gain access as a high-privileged internal account and use NETCONF to alter SD-WAN configuration. Cisco rated it 10.0 out of 10, said there was no workaround, and published updates on Feb. 25. It later added Validator to the advisory on June 16.
Cisco said it was aware of limited exploitation when it disclosed the flaw and credited Australia’s signals-intelligence agency, ASD’s Australian Cyber Security Centre, with reporting it. On Oct. 28, Lumen’s Black Lotus Labs separately said the group known as Volt Typhoon exploited the same vulnerability by late 2025 and continued after disclosure. That is a separate attribution from Talos’s KeyDrift analysis.
Why SD-WAN Key Theft Matters
SD-WAN controllers coordinate connections between an organization’s offices and help manage the encrypted tunnels carrying data between them. If an attacker gains access to a controller, the risk can extend beyond the device itself: control-plane access may expose network configuration and, as Talos describes, key material used to protect traffic. Encryption keys are sensitive assets because their compromise could put communications at risk while those keys remain valid. The report does not confirm that such decryption occurred.
The case also highlights why internet-facing network appliances attract attackers. These systems sit at the boundary between internal networks and outside connections, and their management roles can make them valuable targets. A patch closes the known software flaw, but does not by itself establish that a previously compromised system is clean. Organizations need to consider both remediation and investigation, guided by their own evidence and vendor or government advice.
Products Worth Considering
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
Sony WH-1000XM6 Wireless Noise-Canceling Over-Ear Headphones, Blue, Bundle
Apple iPad Air (4th Generation, 10.9-inch, Wi-Fi, 256GB) – Space Gray
As an affiliate, we earn on qualifying purchases.
The February Cisco Patch
Cisco disclosed CVE-2026-20127 on Feb. 25, 2026, and said there was no workaround. The issue concerns peering authentication, which governs which systems can join an SD-WAN control system. Cisco’s advisory covered the Controller, Manager and Validator, including on-premises and hosted deployments, according to the supplied source material.
US federal agencies were ordered by CISA’s Emergency Directive 26-03 to inventory affected systems, collect evidence and apply updates on a short deadline. A joint alert from agencies in the United States, Australia, Canada, New Zealand and the United Kingdom warned that Cisco SD-WAN systems had been exploited for more than a year. Talos has described earlier exploitation evidence dating back to at least 2023, but its report characterizes the KeyDrift activity as historical without specifying its exact dates.
Talos said infrastructure associated with UAT-11473 overlaps considerably with Silent Train, a relay network that Lumen connects to Volt Typhoon. Overlapping infrastructure is not proof that the groups are identical. The separate Talos and Lumen assessments should not be collapsed into a single confirmed attribution.
““historical””
— Cisco Talos
The Reach of KeyDrift Activity
Talos has not publicly specified how many organizations were affected, the exact period when KeyDrift was active, or whether stolen key material was transferred off compromised systems. The available information also does not establish that attackers decrypted company traffic or what data, if any, they accessed.
Attribution remains qualified. Talos links UAT-11473 infrastructure to Silent Train through substantial overlap, while Lumen separately attributes exploitation of the vulnerability to Volt Typhoon. The supplied material does not establish that UAT-11473, Silent Train and Volt Typhoon are the same actor. The full scope of the activity and any confirmed victim impact remain unclear.
Patch, Investigate and Verify
Organizations using affected Cisco Catalyst SD-WAN products should confirm that they have installed the applicable Cisco security updates and review the vendor advisory for their specific deployment. Patching addresses the disclosed vulnerability, but operators should also investigate whether systems were accessed before the fix and follow guidance from Cisco and relevant government cyber agencies.
Where evidence indicates a controller was compromised, a software upgrade alone may not remove an attacker’s changes or persistence. The supplied source describes CISA guidance for federal agencies to rebuild affected systems from clean images and replace administrative credentials. Organizations should assess key exposure with incident responders and determine whether key rotation or other containment steps are needed. Further clarity depends on additional technical findings from Cisco, Talos, Lumen or affected organizations.
Key Questions
What is KeyDrift?
Talos describes KeyDrift as custom malware found on Cisco Catalyst SD-WAN systems. It says a component reads decrypted controller messages and extracts a 32-byte field assessed as encryption key material.Which Cisco vulnerability was exploited?
The activity involved CVE-2026-20127, a flaw in SD-WAN peering authentication. Cisco disclosed it on Feb. 25, 2026, rated it 10.0 out of 10 and provided security updates.Does the reporting confirm that company traffic was decrypted?
No. Talos says the malware extracted data it assesses as key material, but the supplied reporting does not confirm that attackers used keys to decrypt traffic or specify what information they accessed.Who does Talos say was behind KeyDrift?
Talos attributes the activity to UAT-11473 and says its infrastructure overlaps considerably with Silent Train. Lumen separately says Volt Typhoon exploited the vulnerability; the available information does not prove these names refer to one group.What should organizations using Cisco SD-WAN do?
Confirm that affected systems are updated, review Cisco’s advisory and assess systems for signs of prior compromise. If compromise is suspected, patching alone may not be enough; investigate and follow vendor and government guidance on rebuilding systems and replacing credentials.Source: Thorsten Meyer AI
