{"id":3858,"date":"2026-10-29T09:29:36","date_gmt":"2026-10-29T09:29:36","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3858"},"modified":"2026-10-29T09:29:36","modified_gmt":"2026-10-29T09:29:36","slug":"hackers-exploited-cisco-sd-wan-flaw-to-plant-malware-built-to-steal-encryption-keys","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3858","title":{"rendered":"Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys"},"content":{"rendered":"
\n
<\/a><\/div>\n

Hackers exploited a critical Cisco Catalyst SD-WAN flaw, fixed in February, to plant custom malware inside the systems that control an organization’s SD-WAN network.<\/p>\n

The malware, called KeyDrift<\/strong>, is designed to copy the keys that encrypt traffic between sites and store them for later use, Cisco Talos said<\/a> on October 28. Talos calls the attacks historical but does not specify when they occurred or whether any keys were sent.<\/p>\n

The flaw is tracked as CVE-2026-20127<\/a> and has a CVSS score of 10.0. It allows an unauthenticated remote attacker to bypass authentication and gain administrative privileges on these control systems. On a Controller, the attacker can log in as a high-privileged internal account that is not root.<\/p>\n

When Cisco disclosed the flaw in February, Talos tracked its exploitation as UAT-8616, a cluster of activity it said went back to at least 2023.<\/p>\n

In Cisco’s traditional key exchange<\/a>, each SD-WAN router periodically generates an AES key for its traffic and sends it to the Catalyst SD-WAN Controller (formerly vSmart). The Controller passes the keys on to other routers. A process on the Controller called vdaemon runs the encrypted control connections that carry these keys.<\/p>\n

On a compromised Controller, a KeyDrift component called LittleFilch hooks into vdaemon and reads control messages after they are decrypted. For a preset list of edge routers, it pulls out their IP addresses and a 32-byte field. Talos assesses that field as the AES-256 key material that the Controller passes between routers.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

LittleFilch encrypts what it collects with RSA and writes it to a file. It can then send that data over UDP to an address listed in a settings file, which it deletes after reading. Talos could not recover that settings file.<\/p>\n

The group behind KeyDrift, which Talos tracks as UAT-11473, has targeted space and satellite services, defense and aerospace technology, and policy research.<\/p>\n

The group’s infrastructure \u00aboverlaps considerably\u00bb with Silent Train, Talos assesses with high confidence. Silent Train is the name Lumen’s Black Lotus Labs uses for a network of hacked small-office, home-office, IoT and business devices.<\/p>\n

Lumen says Volt Typhoon used the network to hide its activity. CISA, the NSA and the FBI said in 2024 that Volt Typhoon is a Chinese state-sponsored cyber group.<\/p>\n

Talos links UAT-11473 to Volt Typhoon only through the infrastructure overlap. It does not say the two are the same group, or how UAT-11473 relates to UAT-8616, the cluster it reported in February.<\/p>\n

Separately, Lumen said on October 28<\/a> that Volt Typhoon was exploiting CVE-2026-20127 by late 2025 and continued to exploit it after Cisco disclosed the flaw in February. Lumen does not tie that activity to KeyDrift.<\/p>\n

KeyDrift primarily starts via modified runit scripts that Cisco SD-WAN devices use to launch their services, according to Talos. In one version, the script for the SSH service starts a loader script, conf_sshd, before the real SSH server. The conf_sshd script writes vdaemon’s process IDs to a file, and a tool called rsshd injects KeyDrift’s main module, PolyFlame, into each of those processes.<\/p>\n

\"\"<\/a><\/div>\n

PolyFlame runs in memory inside vdaemon. It can act as a TinyShell-like backdoor that runs commands and reads and writes files, or as a relay that forwards commands between its command server and other machines. It is built to accept commands within SD-WAN control traffic, and the analyzed samples contained no hardcoded server address.<\/p>\n

On a compromised Validator, formerly vBond, a fake aaamgr service under \/etc\/sv\/aaamgr\/ runs a packed loader, aaamgrd, that decrypts and runs PolyFlame. Cisco’s real aaamgr component is a Python package and does not normally run as a compiled service.<\/p>\n

There are also signs of timestomping: commands the group ran copied the timestamps and permissions of existing files onto its own files.<\/p>\n

Affected Releases and Fixes<\/h3>\n

CVE-2026-20127 affects the Catalyst SD-WAN Controller (formerly vSmart), Manager (formerly vManage), and Validator (formerly vBond), regardless of their configuration. On-premises systems are affected, as are Cisco’s hosted SD-WAN cloud deployments, including the Cisco Managed and FedRAMP environments. Cisco added the Validator to its advisory on June 16.<\/p>\n

Cisco says it is aware of limited exploitation of the flaw. There is no workaround, and the first fixed releases are:<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n
Release train<\/th>\nFirst fixed release<\/th>\n<\/tr>\n
Earlier than 20.9<\/td>\nMigrate to a fixed release<\/td>\n<\/tr>\n
20.9<\/td>\n20.9.8.2<\/td>\n<\/tr>\n
20.11<\/td>\n20.12.6.1<\/td>\n<\/tr>\n
20.12<\/td>\n20.12.5.3 or 20.12.6.1<\/td>\n<\/tr>\n
20.13<\/td>\n20.15.4.2<\/td>\n<\/tr>\n
20.14<\/td>\n20.15.4.2<\/td>\n<\/tr>\n
20.15<\/td>\n20.15.4.2<\/td>\n<\/tr>\n
20.16<\/td>\n20.18.2.1<\/td>\n<\/tr>\n
20.18<\/td>\n20.18.2.1<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Releases earlier than 20.9 and the 20.11, 20.13, 20.14 and 20.16 trains have reached end of software maintenance.<\/p>\n

Until they can upgrade, on-premises customers can limit access to ports 22 and 830 to the IP addresses of known controllers and other known systems. Cisco says this step worked in a test environment, but that customers should check how well it works in their own networks. Such guardrails are already in place for Cisco’s hosted SD-WAN cloud deployments.<\/p>\n

Blocking the ports does not remove malware already on a device.<\/p>\n

Checking for KeyDrift<\/h3>\n

Talos advises organizations to install Cisco’s fixes, follow Cisco’s Catalyst SD-WAN hardening guide<\/a> and watch for signs of post-compromise activity. Anyone who finds such signs should start incident response and can ask Cisco’s Technical Assistance Center (TAC) for help.<\/p>\n

That advice does not say whether upgrading removes KeyDrift from a device that was already compromised, or whether any keys should be replaced. Cisco’s February remediation guide<\/a> for this flaw warns that there could be \u00abexisting exploits which are still in place\u00bb from before an upgrade.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

KeyDrift uses these files and locations, some given only by name:<\/p>\n