Hackers used a maximum-severity Cisco SD-WAN flaw to plant key-stealing malware
Organizations running affected Cisco SD-WAN controllers should assume patching alone may not remove existing compromise.
Attackers abused a maximum-severity Cisco Catalyst SD-WAN flaw, CVE-2026-20127 (CVSS 10.0), which was patched in February, to install custom malware named KeyDrift on the control systems of enterprise networks. Cisco Talos says the malware is built to harvest the AES-256 keys that protect traffic between sites and keep them for later use, though it cannot confirm when the activity occurred or whether any keys were actually taken. Talos links the operator, tracked as UAT-11473, to the Silent Train device network and to Volt Typhoon only through shared infrastructure, not as the same group, while Lumen separately reports Volt Typhoon exploiting the same flaw from late 2025 and after disclosure. Operators using the flaw should move to the fixed releases listed by Cisco, such as 20.15.4.2 or 20.18.2.1 depending on the train, and restrict ports 22 and 830 to known controllers as an interim step. Patching does not necessarily remove malware already on a device, so organizations should hunt for signs of compromise and consider rotating keys.
Why it matters
The flaw lets an unauthenticated remote attacker bypass authentication and gain administrative control, and the malware targets the keys that protect traffic between sites. Because patching does not necessarily remove malware already on a device, the risk for organizations that were exposed before updating persists after the fix. Separate reporting that Volt Typhoon exploited the same flaw from late 2025 suggests the exposure may have started well before the February disclosure, though Talos has not tied the two groups together.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.