TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Cisco Talos reported on Oct. 28, 2026, that malware it calls KeyDrift was used against Cisco Catalyst SD-WAN control systems to collect material Talos assesses as encryption keys. Talos and Lumen reported separate findings involving the same vulnerability, CVE-2026-20127, but the public evidence does not establish that the groups they track are the same or say how many organizations were affected.
Cisco Talos said Oct. 28 that a custom malware tool it calls KeyDrift targeted Cisco Catalyst SD-WAN control systems and extracted data Talos assesses as encryption key material. The report links the activity to exploitation of CVE-2026-20127, a Cisco flaw disclosed and patched in February; on the same day, Lumen’s Black Lotus Labs separately said the group known as Volt Typhoon exploited that flaw by late 2025 and continued after its disclosure.
Talos attributes the KeyDrift activity to a group it tracks as UAT-11473. Its analysis says one malware module reads decrypted control messages handled by the SD-WAN controller and extracts a 32-byte field that Talos assesses to be AES-256 key material used for traffic between company sites. The malware’s reported target is the control system that coordinates network operations, rather than an individual branch router.
Cisco describes CVE-2026-20127 as a flaw in peering authentication, which checks whether machines can join the SD-WAN control system. According to Cisco’s advisory, a remotely reachable attacker could send crafted requests, gain access as a high-privileged internal account and use NETCONF to alter SD-WAN configuration. Cisco rated the flaw CVSS 10.0, said there was no workaround and issued updates. The affected products include Catalyst SD-WAN Controller, Manager and Validator, across on-premises and hosted deployments.
Talos said it traced an earlier exploitation cluster to at least 2023, but described the KeyDrift activity as historical without publicly specifying when it occurred. Talos also said UAT-11473 infrastructure overlaps considerably with Silent Train, a relay network associated by Lumen with Volt Typhoon. That overlap does not establish that the groups are identical. Lumen’s separate report says Volt Typhoon exploited the vulnerability by late 2025 and continued after Cisco disclosed it.
Why SD-WAN Key Theft Matters
SD-WAN systems connect offices and route traffic across an organization’s network. Their controllers help coordinate the encrypted links between sites, so access to a controller can put network configuration and sensitive operational information at risk. Talos says KeyDrift sought key material from decrypted controller messages, an approach that targets data while the system is processing it rather than breaking encryption itself.
If valid encryption keys were copied, they could potentially expose traffic protected by those keys while they remain usable. But the published analysis does not confirm that attackers successfully used any extracted keys to decrypt communications. The distinction matters: the reported malware behavior is serious, while the extent of any resulting access remains unknown.
The reports also underline why internet-reachable network infrastructure can be a consequential target. A compromised control system may affect communications across multiple sites, not just one endpoint. For organizations, installing a security update addresses the known flaw, but does not by itself establish that a system previously exposed to exploitation is free of malware or unauthorized access.
Products Worth Considering
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
The February Cisco Patch
Cisco disclosed CVE-2026-20127 on Feb. 25, 2026, and published software updates. Cisco credited Australia’s Australian Signals Directorate’s Australian Cyber Security Centre with reporting the flaw and said it was aware of “limited exploitation.” The advisory was later updated to add the Validator product. Cisco linked the Talos analysis on Oct. 28.
On the disclosure date, the U.S. Cybersecurity and Infrastructure Security Agency issued Emergency Directive 26-03 for federal civilian agencies. It ordered agencies to inventory affected systems, collect evidence and apply updates on a set timetable. Security agencies from the United States, Australia, Canada, New Zealand and the United Kingdom also released a joint alert and hunting guidance, warning that Cisco SD-WAN systems had been exploited for more than a year.
The source material also describes Talos tracking an earlier exploitation cluster as UAT-8616, with evidence dating back to 2023. Those earlier findings are distinct from the UAT-11473 attribution in the KeyDrift report. The reports describe overlapping activity around the same vulnerability, but do not provide enough public evidence to merge the tracked groups.
“limited exploitation”
— Cisco, in its security advisory
What the Reports Do Not Establish
The public material does not state how many organizations were compromised, whether any extracted keys were used to read network traffic or whether the KeyDrift operators retained access after patches were available. Talos calls the activity historical but does not give a date range for the malware’s use or identify victims.
Attribution also remains limited. Talos links UAT-11473 to infrastructure that overlaps with Silent Train, while Lumen separately attributes exploitation of the same flaw to Volt Typhoon. Those findings do not, on their own, prove that UAT-11473, Silent Train and Volt Typhoon are the same actor. The reports also do not establish whether every system exposed to the flaw was targeted or compromised.
Organizations that applied Cisco’s updates cannot infer from patch status alone whether a device was compromised before it was updated. The supplied reporting does not provide a public count of confirmed infections or a complete list of affected victims.
Patching and Checking Controllers
Organizations using the affected Catalyst SD-WAN products should confirm that updates covering CVE-2026-20127 are installed and review Cisco’s advisory and relevant agency guidance. Security teams should also assess whether controllers were exposed before patching, preserve available evidence and investigate for signs of unauthorized accounts, configuration changes or persistent access.
A patch prevents exploitation of the known flaw on a corrected system, but it does not automatically remove malicious software that may already be present. For federal civilian agencies, CISA’s directive specified evidence collection and remediation steps. The source material recommends rebuilding a suspected compromised controller from a clean image and replacing administrative credentials; organizations should follow applicable vendor and government response guidance.
Further reporting from Cisco, Talos, Lumen and government agencies may clarify the timing, scope and consequences of the activity. Until then, the central confirmed point is that researchers reported malware designed to obtain key material from SD-WAN control messages, while the number of affected organizations and any confirmed misuse of those keys remain undisclosed.
Key Questions
What is KeyDrift?
KeyDrift is the name Cisco Talos gave to custom malware reported on Cisco Catalyst SD-WAN control systems. Talos says a module reads decrypted control messages and extracts a 32-byte field it assesses as encryption key material.
Which vulnerability did the reports link to the activity?
The reports identify CVE-2026-20127, a Cisco flaw in SD-WAN peering authentication. Cisco disclosed it on Feb. 25, 2026, rated it CVSS 10.0 and released software updates.
Did the reports confirm that attackers decrypted company traffic?
No. Talos reported malware behavior aimed at collecting data it assesses as key material, but the public analysis does not confirm that attackers used extracted keys to decrypt communications.
Are UAT-11473 and Volt Typhoon confirmed to be the same group?
No. Talos reported infrastructure overlap between UAT-11473 and Silent Train, while Lumen separately attributed exploitation to Volt Typhoon. The reports do not establish that these names refer to one group.
What should organizations do if they use affected Cisco SD-WAN products?
Organizations should verify that Cisco’s security updates are installed and assess whether systems were exposed before patching. If compromise is suspected, a software update alone may not remove existing malware; teams should preserve evidence and follow Cisco and relevant government response guidance.
Source: Thorsten Meyer AI
