Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys
Hackers exploited a critical Cisco Catalyst SD-WAN flaw, fixed in February, to plant custom malware inside the systems that control an organization's SD-WAN network. The malware, called KeyDrift, is designed to copy the keys that encrypt traffic between sites and store them for later use, Cisco Talos said on October 28. Talos calls the attacks historical but does not specify when they
Hackers took advantage of a recently patched vulnerability in Cisco's Catalyst SD-WAN systems to inject malware capable of stealing encryption keys, according to an analysis by Cisco Talos. The malware, dubbed KeyDrift, was designed to copy encryption keys used to secure traffic between different SD-WAN sites, allowing the attackers to store them for future use.
Cisco has tracked this flaw as CVE-2026-20127, which carries a high CVSS score of 10.0 and can be exploited by unauthenticated remote attackers to gain administrative access to the control systems.
The security researchers discovered that KeyDrift operates by hooking into a process called vdaemon, which handles control connections carrying the encryption keys. Once inside, the malware reads the keys and encrypts them using RSA before sending the data to a predetermined address. Talos has linked the KeyDrift group to a larger network known as Silent Train, which has been associated with various high-profile cyber threats. However, the exact relationship between the two remains unclear.
Cisco promptly released a patch for the vulnerability in February, but attackers continued to exploit it even after the disclosure. The group responsible for KeyDrift overlaps with another threat actor known as Volt Typhoon, though the exact connection between the two groups is not definitively established. Lumen, a Cisco subsidiary, reported that the group had been exploiting the vulnerability as late as late 2025, even after Cisco's initial patch.
The vulnerability affects Cisco's Catalyst SD-WAN Controller, Manager, and Validator systems, regardless of their configuration. On-premises deployments and cloud-based services are equally at risk. Cisco has recommended several remediation steps, including limiting access to specific ports and upgrading to the latest software versions.
However, these measures may not completely eliminate the threat, as the malware could potentially remain on compromised devices. Cisco advises organizations to install the patches, follow hardening guidelines, and monitor for signs of post-compromise activity.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
