The Spies in the Listening Room: How KeyDrift Infiltrated Cisco SD-WAN to Steal Encryption Secrets
The intelligence headquarters was quiet.
Behind reinforced doors, encrypted communications travelled between distant outposts. Military contractors, satellite operators and research organizations depended on networks designed to keep sensitive information away from unauthorized listeners.
Every transmission was protected.
Every conversation had a key.
And every key passed through a trusted communications system.
But somewhere inside that system, a listening device had been planted.
The spies weren’t recording ordinary conversations. They had found something far more valuable: the place where encryption keys were exchanged.
They waited for the messages to be decrypted, copied the secrets passing through the system and prepared them for delivery to an unknown destination.
The communications were still encrypted. But the spies were listening from inside the room where the encryption was managed.
This is the story of KeyDrift, a custom malware framework identified by Cisco Talos in historical attacks against Cisco Catalyst SD-WAN infrastructure.
Phase 1 — The Communications Network
Imagine an intelligence organization with listening posts and operational headquarters scattered across the world.
Each location must communicate securely with the others.
Sensitive information travels across long distances, protected by encryption.
Cisco Catalyst SD-WAN performs a comparable function for enterprise networks, coordinating connectivity between geographically distributed locations.
In the traditional key exchange examined by Talos, each SD-WAN edge router periodically generates an AES key for its traffic.
The router sends that key to the Catalyst SD-WAN Controller, formerly known as vSmart.
The Controller distributes the appropriate key material to other routers.
A process named vdaemon handles the encrypted control connections through which these exchanges occur.
This creates a sensitive point in the communications infrastructure.
The Controller does not merely help coordinate the network.
It participates in distributing the cryptographic material protecting traffic between sites.
For an intelligence agency, this would be the communications room where the codes are exchanged before the agents begin speaking.
Phase 2 — The Spy Enters Headquarters
The intrusion began with a critical vulnerability:
CVE-2026-20127 — CVSS 10.0.
The flaw affects Cisco Catalyst SD-WAN Controllers, Managers and Validators.
It allows an unauthenticated remote attacker to bypass authentication and gain administrative privileges.
On a Controller, the attacker can access a highly privileged internal account, although not root.
Cisco fixed the vulnerability in February 2026.
At that time, Talos tracked exploitation activity under UAT-8616, a cluster whose history reportedly extended back to at least 2023.
The later discovery of KeyDrift revealed how attackers could exploit access to the control infrastructure for a particularly sensitive purpose.
Talos tracks the group behind KeyDrift as UAT-11473, but has not established its relationship with UAT-8616.
The critical point is what the vulnerability made possible.
An attacker could reach systems entrusted with managing the network’s encrypted communications.
The spy wasn’t standing outside headquarters with a listening device. He had found a way into the building.
Phase 3 — Planting the Listening Device
Once inside, the attackers needed their malware to operate without attracting attention.
KeyDrift used modified runit service scripts, which Cisco SD-WAN devices rely on to launch legitimate services.
In one observed version, the attackers altered the SSH startup script.
Before the real SSH server started, an additional script named conf_sshd executed.
That script identified the process IDs of vdaemon and stored them for another tool, rsshd.
The injector then loaded KeyDrift’s main module, PolyFlame, into the running vdaemon processes.
The result was malicious code executing inside a legitimate control process.
Rather than launching an obviously separate spying application, the attackers embedded their capabilities within software that already handled sensitive network operations.
The listening device wasn’t left on a desk. It was installed inside the communications equipment itself.
Phase 4 — The Agent Behind the Wall
PolyFlame was designed to operate in memory within vdaemon.
It provided capabilities similar to a TinyShell backdoor, including command execution and file access.
It could also function as a relay, forwarding commands between external infrastructure and other machines.
One of its most significant features was its ability to accept instructions through SD-WAN control traffic.
The attackers could therefore use the environment’s own communication mechanisms to deliver commands.
Talos found no hardcoded command-and-control server address in the analyzed samples.
This limited investigators’ ability to identify the precise destination of attacker communications from the malware alone.
The architecture was particularly suited to covert activity.
A malicious component was operating inside a trusted process, using legitimate control channels as part of its communication strategy.
The spy didn’t need to make an obvious call to a foreign number. His instructions could travel through the headquarters’ own communications network.
Phase 5 — A Second Spy With a False Identity
On compromised Catalyst SD-WAN Validators, formerly known as vBond devices, Talos identified a different deployment mechanism.
The attackers created a fake service under:
/etc/sv/aaamgr/
The service launched a packed executable named aaamgrd.
That executable decrypted and ran PolyFlame.
The name was carefully chosen.
Cisco has a legitimate component called aaamgr, but the real component is a Python package rather than the compiled service observed in the malicious installation.
The attackers also appeared to manipulate timestamps and file permissions, copying attributes from existing files onto their own.
This technique, known as timestomping, can make suspicious files appear older or more consistent with their surroundings.
The second spy had a convincing identification badge, a familiar job title and paperwork designed to suggest he had always worked there.
Phase 6 — The Eavesdropper Called LittleFilch
PolyFlame provided access and covert operational capabilities.
But KeyDrift contained another component with a more specialized mission.
LittleFilch.
This module hooked into vdaemon and inspected control messages after they had been decrypted.
For a predefined list of edge routers, it extracted their IP addresses and a 32-byte field.
Talos assessed that this field represented AES-256 encryption key material exchanged between routers.
That distinction is crucial.
The malware was not simply listening to encrypted traffic travelling across the network.
It was positioned where sensitive information could be examined after decryption.
LittleFilch encrypted the collected material using RSA and stored the resulting records locally.
It also had functionality to send those records over UDP to an address specified in a configuration file.
The configuration file was deleted after being read, and Talos could not recover it.
Consequently, researchers could not determine whether the collected material had actually been transmitted.
The listening device was designed to copy the encryption codes. Whether those copies reached the spies’ handlers remains unknown.
Phase 7 — Listening Without Breaking the Cipher
Encryption protects communications by making intercepted information unreadable without the appropriate cryptographic material.
But encryption depends on the security of its keys.
If an attacker gains access to the keys protecting particular communications, the confidentiality of those communications may be at risk.
The exact consequences depend on the encryption design, key lifetimes, the traffic available to the attacker and other technical conditions.
Talos did not establish that the attackers successfully decrypted customer communications.
Nor did it confirm that KeyDrift exfiltrated the suspected key material.
What the analysis demonstrates is the malware’s intended objective.
The attackers wanted to obtain the cryptographic secrets distributed through the SD-WAN control infrastructure.
This makes KeyDrift different from malware focused exclusively on stealing documents or passwords.
The spies weren’t trying to overhear one classified conversation. They were trying to acquire the codes that could make protected conversations intelligible.
Phase 8 — The Network of Secret Listening Posts
Talos attributed the KeyDrift activity to the cluster it tracks as UAT-11473.
The group has targeted organizations in space and satellite services, defense and aerospace technology, and policy research.
Talos also assessed with high confidence that infrastructure associated with UAT-11473 overlapped considerably with Silent Train.
Silent Train is the name used by Lumen’s Black Lotus Labs for a network of compromised small-office, home-office, IoT and business devices.
Lumen has reported that Volt Typhoon used this infrastructure to conceal its operations.
U.S. authorities have identified Volt Typhoon as a Chinese state-sponsored cyber group.
However, infrastructure overlap is not proof that the same actors conducted every operation.
Talos did not conclude that UAT-11473 and Volt Typhoon were identical.
Separately, Lumen reported that Volt Typhoon exploited CVE-2026-20127 by late 2025 and continued after Cisco disclosed the vulnerability.
That reporting did not establish a direct connection between Volt Typhoon and KeyDrift.
The distinction matters.
Different intelligence services can use the same network of safe houses without necessarily working on the same mission.
Phase 9 — The Listening Room Is Secured
Cisco released fixes for CVE-2026-20127 in February 2026.
The vulnerability affects on-premises deployments and Cisco-hosted Catalyst SD-WAN environments, including managed and FedRAMP offerings.
The first fixed releases include:
Release train | First fixed release |
Earlier than 20.9 | Migrate to a fixed release |
20.9 | 20.9.8.2 |
20.11 | 20.12.6.1 |
20.12 | 20.12.5.3 or 20.12.6.1 |
20.13–20.15 | 20.15.4.2 |
20.16–20.18 | 20.18.2.1 |
Some older release trains have reached the end of software maintenance.
Cisco states that there is no workaround for the underlying vulnerability.
For on-premises environments awaiting an upgrade, restricting access to ports 22 and 830 to known systems may reduce exposure, subject to validation in the customer’s network.
But there is an important limitation.
An upgrade prevents exploitation of the patched vulnerability.
It does not automatically prove that previously implanted malware has been removed.
Repairing the entrance to headquarters does not guarantee that every listening device inside has been discovered.
Phase 10 — Sweeping the Building for Bugs
Investigators should look for the persistence mechanisms and files associated with KeyDrift.
Talos identified several relevant artifacts:
Modified startup scripts under /etc/sv/sshd/.
A suspicious service directory at /etc/sv/aaamgr/.
conf_sshd, used as a loader script.
rsshd, used for process injection.
aaamgrd, the packed Validator loader.
libdssl.so, associated with PolyFlame.
libcommon.so, associated with LittleFilch.
/tmp/system-vdaemon, containing vdaemon process IDs.
/var/tmp/vdaemon.bin, containing encrypted records.
/var/tmp/vdaemon.conf, containing transmission settings before deletion.
Cisco also advises checking /var/log/auth.log for unexpected entries involving:
Accepted publickey for vmanage-admin
Unknown source IP addresses warrant investigation.
Talos released additional Snort detection rules on October 28.
These include 67387–67416 for Snort 2 and 7:44–7:73 for Snort 3.
The October update lists the Snort 2 rules as disabled by default, meaning relevant subscribers must explicitly enable them.
Previously published rules 65938 and 65958 cover exploitation associated with CVE-2026-20127.
These detections can help identify suspicious activity, but they are not a substitute for comprehensive forensic investigation.
A listening device may be silent when the security team enters the room. That doesn’t mean it was never there.
Phase 11 — Can the Communications Still Be Trusted?
Organizations that identify signs of compromise should initiate incident response and seek vendor assistance where appropriate.
Cisco recommends collecting diagnostic information using request admin-tech on each SD-WAN control component before opening a Technical Assistance Center case.
Its remediation guidance also recommends using the Bug Search Tool’s Check Bug Applicability feature for bug CSCws52722.
The investigation should establish whether malicious processes, modified service scripts or other persistence mechanisms remain.
It should also consider the integrity of the affected control infrastructure and the potential exposure of encryption-related material.
Cisco’s October guidance does not establish whether upgrading removes KeyDrift from an already compromised system or whether specific keys must be replaced.
Those questions require case-specific investigation and vendor-supported remediation.
For U.S. federal civilian agencies, CISA’s February 25 emergency directive imposes additional obligations when root-account compromise is identified, including reporting and rebuilding affected control infrastructure from patched images.
The larger lesson extends beyond the immediate vulnerability.
Once spies have occupied the communications room, security teams must verify both the equipment and the secrets it handled before declaring the channel trustworthy again.
The Final Transmission — The Spies Were Listening From Inside
KeyDrift reveals a particularly dangerous form of infrastructure compromise.
The attackers exploited a critical authentication-bypass flaw in Cisco Catalyst SD-WAN systems.
They embedded malware within legitimate control processes, created deceptive services and developed capabilities for covert command execution.
Their specialized collection component targeted material Talos assessed as AES-256 encryption keys.
The investigation does not confirm that those keys were exfiltrated or used to decrypt communications.
But it demonstrates the risk of compromising the infrastructure responsible for exchanging cryptographic secrets.
The network’s encryption may remain mathematically strong.
Its protected traffic may continue flowing normally.
Yet an attacker positioned inside the trusted control environment may be able to collect information that undermines those protections.
The spies didn’t need to sit outside the building with headphones, struggling to interpret encrypted transmissions.
They had found a way into the listening room itself.
The most dangerous spy isn’t the one who intercepts your conversations.
It’s the one listening when you exchange the keys that protect them.
The Hacker News
Comentarios