KeyDrift: Malware on Cisco SD-WAN Controllers Built to Steal Encryption Keys, Tied to Volt Typhoon's Silent Train Network

On 28 October 2026, Cisco Talos, Cisco's own threat intelligence team, published its analysis of KeyDrift, custom malware that attackers planted on Cisco Catalyst software-defined wide area network (SD-WAN) controllers. The controllers are the central systems that set routes and hand out encryption keys for the links between sites. Talos tracks the group behind it as UAT-11473 and calls it a highly sophisticated advanced persistent threat (APT), meaning a well-funded group that aims to stay inside for a long time. Talos assesses with high confidence that the group's infrastructure "overlaps considerably" with Volt Typhoon's "Silent Train" covert network. Talos does not say they are the same group. Talos calls the activity historical and has not said when it happened.

How this connects to the Silent Train report. Red Tiger Security covered the Black Lotus Labs report on Silent Train on 28 October. That report named a Volt Typhoon zero-day campaign against Cisco Catalyst SD-WAN, tracked as Common Vulnerabilities and Exposures entry CVE-2026-20127. The flaw is rated 10 out of 10, was disclosed by Cisco in February 2026 and has been on the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog since 25 February. It lets an attacker with no password get past the controller's peering login and gain administrator-level access. The Talos report shows what an attacker did after getting in. Cisco updated its CVE-2026-20127 advisory on 28 October to point to the Talos post. Full background: https://www.redtigersecurity.com/advisory/volt-typhoon-silent-train

What is new. According to Talos, UAT-11473 used CVE-2026-20127 to get into SD-WAN controllers and then installed KeyDrift inside the controller's own legitimate processes. Its main piece, PolyFlame, is a backdoor that can run commands, read and write files, and pass commands along to other hacked systems. A second piece, LittleFilch, reads control traffic after it has been decrypted and copies key material, which Talos believes includes the keys that protect traffic between sites. Talos says KeyDrift is built for long-term access and is started by altered service startup scripts on the controller. Observed targets were space and satellite services, defense and aerospace technology, and policy research. Talos also saw signs that the malware is still being developed.

Why a patch alone is not enough. Cisco released fixes for CVE-2026-20127 in February. In the Red Tiger team's view, a patch closes the door but does not prove nobody came in before it closed. If a controller was broken into before the update, malware like KeyDrift may still be there, and any keys and credentials it copied should be treated as exposed.

Where this shows up from the plant floor to the cloud. Utilities, pipelines and manufacturers use SD-WAN to link substations, pump stations, compressor sites and plants back to a control center or data center. The controller decides how that traffic flows and hands out the keys that protect it. An attacker who holds the controller can see and change how sites talk to each other. If the SD-WAN management network also reaches the control system network, called operational technology (OT), the controller can become a path toward it.

What it means for OT owners. Talos did not report OT victims. The concern is the design. The attacker went after the system that holds the keys to every site link, and stayed there quietly.

What the Red Tiger team recommends:

1. Confirm your patch level. Check that every SD-WAN Controller, Manager and Validator runs a fixed release from Cisco's advisory, and move off releases that no longer get updates.
2. Run Cisco's compromise checks. Follow the checks in Cisco's advisory: review controller authentication logs for administrator logins from unknown addresses, validate every control connection peering event against known devices and maintenance windows, and collect an admin-tech file from each control component for Cisco's Technical Assistance Center (TAC). Talos has also published detection rules for KeyDrift. If anything looks wrong, start your incident response plan and open a TAC case.
3. Rotate keys and certificates if there is any doubt. If a controller may have been compromised, work with Cisco to rebuild it from known-good software and to rotate SD-WAN keys, certificates and administrator credentials.
4. Review control plane access logs. Send controller logs to a central system, keep them long enough to investigate, and look back as far as you can for logins and peering at odd times or from unknown addresses.
5. Separate the management plane from OT. Keep controller management off the internet, allow only known controller and administrator addresses, and make sure the SD-WAN management network is not a path into control systems.

With 500+ assessments across critical infrastructure, the Red Tiger Security team helps owners review SD-WAN and remote site architecture with plant-safe methods, separate management networks from OT, and set up monitoring that can spot misuse of trusted management systems.

We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min

Sources:
Cisco Talos, "Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN," 28 October 2026: https://blog.talosintelligence.com/uat-11473-keydrift/
Cisco, "Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability," cisco-sa-sdwan-rpa-EHchtZk, first published 25 February 2026, updated 28 October 2026: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk
SecurityWeek, Eduard Kovacs, 29 October 2026: https://www.securityweek.com/cisco-sd-wan-zero-day-exploitation-tied-to-volt-typhoons-silent-train-network/
Black Lotus Labs (Lumen), "Silent Train: uncovering Volt Typhoon's operational framework for zero-day exploitation and strategic access," 28 October 2026: https://www.lumen.com/blog/en-us/silent-train-volt-typhoon-operational-framework

‍