Overview
- Cisco Talos on October 28–29 published details of KeyDrift, a modular malware framework implanted via CVE-2026-20127 that targets Catalyst SD‑WAN Controller, Manager and Validator processes.
- KeyDrift uses two main modules: LittleFilch hooks the vdaemon process to read decrypted control‑plane messages and extract a 32‑byte field Talos assesses as AES‑256 IPsec key material, and PolyFlame runs in memory to provide a backdoor and relay functions.
- The underlying bug, CVE-2026-20127, is an authentication‑bypass flaw Cisco patched in February 2026 and Cisco has published fixed images and hardening guidance for specific release trains.
- Researchers say the threat cluster UAT-11473’s infrastructure overlaps heavily with the Silent Train network tied to Volt Typhoon, but Talos does not make a definitive attribution and Lumen reported related exploitation timelines dating back to late 2025.
- Operational risk remains high because upgrades do not guarantee removal of implants or stolen keys; CISA’s emergency directive requires federal agencies to report compromises and redeploy from patched images, and Talos and vendors have released Snort detection rules and response guidance.