Spies sat inside Cisco SD-WAN controllers and copied the encryption keys. Check yours is patched and clean

Cisco Talos published a report on October 28 about a group that broke into Cisco SD-WAN controllers and left malware that copies the keys protecting traffic between sites. The entry point is a February bug with a 10.0 score and a fix that has been out for eight months.

The report does not say when the intrusions happened. That is the reason to check: a controller that was exposed before it was patched can still be carrying the implant.

An SD-WAN controller handles the key material for the sites it manages. A February patch does not remove malware planted before it.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Talos found spyware in Cisco SD-WAN controllers that copies the encryption keys

Talos tracks the group as UAT-11473 and calls it a highly sophisticated APT. It exploited CVE-2026-20127, an authentication bypass in the peering authentication of Cisco Catalyst SD-WAN Controller, Manager and Validator, to get administrator access, and then installed a malware framework Talos names KeyDrift. Observed targets include space and satellite services, defense and aerospace technology, and policy research.

Talos says the group’s infrastructure overlaps considerably with Volt Typhoon’s “Silent Train” covert network. SecurityWeek adds that Talos does not say the two are the same group. Talos calls the activity historical and gives no dates.

KeyDrift has two main parts. PolyFlame sits in memory inside the controller’s vdaemon process and gives the operators command execution and a relay to other peers. LittleFilch hooks the process’s TLS reads and pulls out what Talos assesses is AES-256 key material for IPsec data traffic between sites, stores it encrypted and sends it out over UDP.

Teams that run Cisco Catalyst SD-WAN controllers

Cisco’s advisory says the flaw affects Controller, Manager and Validator regardless of configuration, on-premises and in Cisco-hosted deployments, and that no workaround exists. The only fix is a software update.

Keys taken from the control plane do not expire when you patch. If they are the data-plane keys Talos believes they are, whoever holds them could read the site-to-site traffic they protect until the keys rotate. A version check does not answer that.

Confirm the February fix, then look inside the controller

• Confirm each Controller, Manager and Validator runs a fixed release: 20.9.8.2, 20.12.5.3 or 20.12.6.1, 20.15.4.2, or 20.18.2.1, or later in your train. Releases earlier than 20.9 have no fix, so move to a supported release.
• Read Cisco’s advisory for the auth.log audit it recommends, and follow Cisco’s SD-WAN hardening guide that Talos links.
• Run the file and process checks under Hunt / verify on every controller that was reachable before it was patched.
• If anything matches, start incident response and open a TAC case, as Talos advises. Because the malware copies key material, plan to re-key the fabric from a clean controller.

Details

• CVE: CVE-2026-20127, peering authentication bypass in Cisco Catalyst SD-WAN Controller (vSmart), Manager (vManage) and Validator (vBond). CVSS 10.0. Cisco disclosed it in February 2026.
• Fixed releases (Cisco): 20.9 to 20.9.8.2; 20.12 to 20.12.5.3 or 20.12.6.1; 20.15 to 20.15.4.2; 20.18 to 20.18.2.1. Releases 20.11, 20.13, 20.14 and 20.16 map to 20.12.6.1, 20.15.4.2 and 20.18.2.1 and have reached end of maintenance.
• KeyDrift pieces (Talos): PolyFlame libdssl.so injected into vdaemon by rsshd, started from changed runit service scripts; a packed aaamgrd variant under /etc/sv/aaamgr/; LittleFilch libcommon.so writing RSA-encrypted records to /var/tmp/vdaemon.bin.
• Coverage: Snort SIDs 65938 and 65958 for the CVE, and 67387 through 67416 (Snort 2) for the artifacts.

Hunt / verify

• List /etc/sv/aaamgr/ and /etc/sv/sshd/. Talos says the real aaamgr is a Python package, so a compiled ELF file named aaamgrd there is a red flag, as are extra lines in the sshd run script that remount /rootfs.rw as executable.
• Look for /var/tmp/vdaemon.bin, /tmp/system-vdaemon and the library names libdssl.so and libcommon.so.
• Review peering events and auth.log for peers or logins you did not authorize, as Cisco’s advisory suggests.

Source: Cisco Talos report on KeyDrift; Cisco advisory for CVE-2026-20127

Sources

• Cisco Talos: Inside KeyDrift, historical UAT-11473 activity on Cisco SD-WAN
• Cisco: Catalyst SD-WAN Controller Authentication Bypass Vulnerability
• SecurityWeek: Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s Silent Train Network
• NVD: CVE-2026-20127

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].