TL;DR
Get business pricing on networking and server gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Cisco Talos reported on Oct. 28, 2026, that custom malware it calls KeyDrift was used against Cisco Catalyst SD-WAN control systems to collect encryption-key material. The activity involved CVE-2026-20127, a critical flaw Cisco patched in February; the scale of compromise and whether keys were taken from affected networks remain unknown.
Cisco Talos said Oct. 28 that a custom malware family it calls KeyDrift targeted Cisco Catalyst SD-WAN control systems, where it could collect material assessed as encryption keys for traffic between an organization’s sites. The malware used CVE-2026-20127, a critical vulnerability Cisco disclosed and patched in February; the number of organizations affected and whether keys were removed from compromised systems are not known.
Talos attributes the KeyDrift activity to a group it tracks as UAT-11473. According to its analysis, one malware module reads decrypted control messages handled by an SD-WAN controller and extracts a 32-byte field that Talos assesses to be AES-256 key material. The report describes a capability and the researchers’ assessment of that field; the available source material does not establish that attackers successfully collected keys from every system where the malware was found.
CVE-2026-20127 affects Cisco Catalyst SD-WAN Controller, Manager and Validator products. Cisco’s advisory says an attacker able to reach an affected system could send crafted requests and gain access as a privileged internal account, then use NETCONF to change SD-WAN configuration. Cisco rated the flaw CVSS 10.0 and said there was no workaround. It published an update on Feb. 25 and later added the Validator to the advisory on June 16.
Talos says it traced an earlier cluster of exploitation to at least 2023, but described the KeyDrift activity as historical without specifying when it occurred. Separately, Lumen’s Black Lotus Labs said on Oct. 28 that it observed Volt Typhoon exploiting the same vulnerability by late 2025 and continuing after Cisco disclosed it. Talos reported considerable infrastructure overlap between UAT-11473 and Silent Train, a relay network Lumen links to Volt Typhoon; Talos did not say the groups are identical.
Why Stolen SD-WAN Keys Matter
SD-WAN controllers coordinate network connections between locations such as offices and data centers. In the setup described by Talos, the controller handles control messages that carry key material used to protect traffic between sites. Malware positioned there could target the management and key-distribution layer, rather than breaking the encryption algorithm itself.
If an attacker obtains valid keys, that may create a risk to communications protected by them while the keys remain usable. But the source material does not confirm that any keys were exfiltrated, how long any could remain valid, or whether attackers decrypted network traffic. Those distinctions matter: malware capability is not proof of successful key theft, and the report gives no confirmed count of affected organizations or data exposure.
The incident also illustrates why network infrastructure is a high-impact target. A controller can influence connections across many sites, so access to one may have consequences beyond a single endpoint. A security update closes the known vulnerability, but it does not by itself establish that a previously compromised system is clean.
Products Worth Considering
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From February Patch to October Report
Cisco disclosed CVE-2026-20127 on Feb. 25, 2026, and said it was aware of limited exploitation. The U.S. Cybersecurity and Infrastructure Security Agency issued Emergency Directive 26-03 that day, directing federal civilian agencies to identify affected systems, collect evidence and apply updates by a Feb. 27 deadline. A joint alert from agencies in the United States, Australia, Canada, New Zealand and the United Kingdom warned that Cisco SD-WAN systems had been exploited for more than a year, according to the supplied source material.
Talos previously tracked exploitation under a different designation, UAT-8616, and reported evidence dating back to at least 2023. The source says attackers in that earlier activity downgraded software and exploited an older vulnerability, but the supplied account cuts off before providing further details. On Oct. 28, Talos published its KeyDrift analysis, while Lumen separately reported its findings about Volt Typhoon and the same Cisco flaw.
The source material also cites broader indicators of risk: Google counted 21 exploited zero-days in security and networking products in 2025, and Verizon said vulnerability exploitation was the most common initial access method in its breach data, at 31%. These figures provide general context; they do not measure the number of victims or the impact of the KeyDrift activity.
““historical””
— Cisco Talos
The Scope of Key Exposure
The available reports do not establish how many organizations were compromised, whether attackers extracted usable keys, or whether they accessed or decrypted traffic between sites. Talos did not date the KeyDrift activity or identify its victims in the supplied account. It also did not equate UAT-11473 with Volt Typhoon; the reported infrastructure overlap is not, on its own, confirmation of shared operators.
It is also unclear whether all affected organizations have identified and removed any malware or whether stolen key material, if any, remains usable. Cisco’s patch addresses the vulnerability, but it cannot establish the integrity of a system that may have been compromised before the update.
Patch, Investigate, Rebuild if Needed
Organizations using affected Cisco Catalyst SD-WAN products should confirm that they have installed the relevant Cisco updates and review the vendor advisory and government guidance. Because a patch does not remove an existing implant, administrators should also investigate potentially affected controllers for signs of compromise and assess whether configuration changes or credentials may have been exposed.
The supplied source says CISA directed U.S. federal agencies to collect evidence and apply updates. It also recommends rebuilding a system from a clean image and replacing administrative credentials if compromise is suspected, rather than treating an upgrade as proof that the device is safe. Any decision to replace or rotate network key material should be based on incident investigation and applicable vendor or agency guidance.
Further reporting from Cisco, Talos and Lumen may clarify the activity’s timing, targets and impact. Until then, the vulnerability and malware findings are reported, while successful key theft, the number of victims and any resulting access to protected traffic remain unconfirmed.
Key Questions
What is KeyDrift?
KeyDrift is the name Cisco Talos gave to custom malware it says was found on Cisco Catalyst SD-WAN control systems. Talos reported that one module could read decrypted controller messages and extract a 32-byte field it assesses as AES-256 key material.
What vulnerability did the malware use?
Talos linked the activity to CVE-2026-20127, a critical Cisco SD-WAN vulnerability. Cisco disclosed and patched it on Feb. 25, 2026, and rated it CVSS 10.0.
Has Cisco confirmed that attackers stole network keys?
The supplied reports describe malware designed to obtain key material, but do not confirm that attackers successfully extracted keys from affected networks or used them to read traffic. The scale and impact remain unknown.
Are UAT-11473 and Volt Typhoon the same group?
That has not been established in the supplied reporting. Talos said UAT-11473’s infrastructure overlapped considerably with Silent Train, which Lumen associates with Volt Typhoon. Infrastructure overlap alone does not confirm common operators.
What should organizations with Cisco SD-WAN systems do?
They should confirm that affected systems are updated, review Cisco and government guidance, and investigate for signs of earlier compromise. If a controller may have been compromised, installing the patch alone may not be sufficient; a clean rebuild and credential replacement may be appropriate under incident-response guidance.
Source: Thorsten Meyer AI
