Volt Typhoon

Cisco Talos Details KeyDrift Malware Exploiting Critical CVE-2026-20127 Zero-Day in Catalyst SD-WAN

Cisco Talos published an analysis on October 28, 2026, of the KeyDrift malware set designed to reside inside Catalyst SD-WAN controllers and extract keys protecting inter-site traffic. The initial access vector was the critical CVE-2026-20127 authentication bypass, scored 10.0 on CVSS 3.1, affecting the peer authentication mechanism between the Catalyst SD-WAN Controller, Manager, and Validator. Attackers could obtain administrative privileges remotely without credentials by sending crafted requests. The Cisco patch was released in February 2026 and the CVE was added to the CISA catalog on February 25 with a two-day remediation deadline. KeyDrift consists of two core modules: the memory-resident PolyFlame backdoor injected into vdaemon processes and the LittleFilch component that intercepts decrypted session identifiers and 32-byte AES-256 IPsec keys distributed via the OMP protocol. Observed targets include space and satellite services, defense contractors, aerospace technology firms, and public policy research institutes. Talos assesses with high confidence that the UAT-11473 infrastructure overlaps significantly with the Silent Train access network linked to Volt Typhoon, though the groups are not confirmed to be identical.