Science & Tech · Cybersecurity · 2 hrs ago
Hackers Used Cisco SD-WAN Flaw to Install Malware That Harvests Encryption Keys
Hackers exploited a critical flaw in Cisco SD-WAN systems to install custom malware on devices that manage network connections between an organization’s sites.
The vulnerability, CVE-2026-20127, lets a remote attacker bypass authentication and gain administrative access; Cisco disclosed it in February 2026.
The malware, called KeyDrift, is designed to collect encryption keys used to protect traffic between sites.
Researchers say it can read control messages after they are decrypted, but they do not know whether any keys were sent to the attackers.
Talos says the attackers’ infrastructure overlaps with Volt Typhoon’s Silent Train network, which routes activity through hacked devices to conceal it.
That overlap does not establish that the KeyDrift operators and Volt Typhoon are the same group, and Lumen’s account of Volt Typhoon exploiting the flaw is separate from Talos’s KeyDrift findings.
The flaw could give attackers broad access to network controls, and Lumen says victims included government, defense, telecommunications and critical infrastructure organizations.
Talos calls the KeyDrift activity historical but has not said when it happened; the available accounts do not describe what happens next.
Hackers exploited the critical Cisco SD-WAN vulnerability CVE-2026-20127 to install malware designed to collect encryption key material.
Cisco Talos named the malware KeyDrift and said it was found on systems that control SD-WAN networks.
The flaw allows an unauthenticated remote attacker to bypass authentication and gain administrative privileges.
Talos attributes the activity to UAT-11473 and says its infrastructure overlaps considerably with Volt Typhoon’s Silent Train network.
Talos and Lumen describe related exploitation but do not say UAT-11473 and Volt Typhoon are the same group or that the activity involved the same malware.
- Who
- UAT-11473, according to Cisco Talos. Talos says its infrastructure overlaps with Volt Typhoon’s Silent Train network.
- What
- Hackers exploited a Cisco SD-WAN flaw to install KeyDrift, malware designed to collect encryption key material.
- When
- Talos calls the attacks historical but does not specify when they occurred. Lumen says Volt Typhoon exploited the flaw by late 2025 and continued after its February 2026 disclosure.
- Where
- Cisco Catalyst SD-WAN controllers and other control systems. The targeted organizations included telecoms, government, defense, satellite and critical infrastructure entities.
- Why
- Not stated. Lumen says the victimology points to efforts to gain footholds useful during a geopolitical crisis, and a researcher also believes the activity involved espionage.
This story does not have two clearly opposing sides.
Lumen says Volt Typhoon was exploiting CVE-2026-20127 by this time.
Cisco disclosed the vulnerability.
Cisco Talos described KeyDrift and its historical activity; Lumen also published research on Silent Train.
SecurityWeek and The Hacker News published reports on the activity.
- Vulnerability
- CVE-2026-20127; CVSS score 10
- Malware
- KeyDrift, designed to collect keying material
- Malware modules
- PolyFlame acts as a backdoor and command relay; LittleFilch collects keying material
- Threat actor
- UAT-11473, as tracked by Cisco Talos
- Related network
- Silent Train, which Lumen says Volt Typhoon used
- Disclosure
- Cisco disclosed the flaw in February 2026
3 sources
What people are saying
overlaps considerably with Volt Typhoon’s ‘Silent Train’ covert access network
Every zero-day campaign through Silent Train targeted this kind of platform