Hackers have exploited a critical flaw in Cisco SD-WAN systems to install malware called KeyDrift. Reportedly, the malware is designed to collect encryption keys that protect data moving between company sites. On October 28, Cisco Talos reported on the activities, but never mentioned when they actually happened or whether any keys were sent.
The flaw, known as CVE-2026-20127, has the highest severity score of 10 out of 10. This flaw lets remote attackers bypass login security and gain access to affected Cisco Catalyst SD-WAN control systems. Once inside, KeyDrift can read network messages after they have been decrypted and collect data that Talos believes contains AES-256 encryption keys.
On an affected controller, the KeyDrift element called LittleFilch impacts vdaemon and reads control messages after they are decrypted. LittleFilch encrypts what it collects with RSA and writes it to a file. Later, it sends that data over UDP to an address listed in a settings file, which it deletes after reading.
According to the reports, the group behind KeyDrift, which Talos tracks as UAT-11473, has targeted space and satellite services, defense and aerospace technology, and policy research. Cisco advises customers to install the fixed software, follow its security guidance and watch for unusual activity. If a company finds signs of a breach, it should begin an incident response process and seek expert help.
Also Read: What AI-Powered Cybersecurity Services May Do for Businesses
Encryption keys help keep data safe as it moves between sites. If an attacker has a valid key, it can read the messages or data based on how the keys are used and what other protections are in place. Talos found malware designed to collect key data, but it has not confirmed that attackers sent out the keys or used them to read private information.
The Cisco attack shows why companies must do more than install updates. They need to check for signs of past breaches, remove malware, and review the safety of their networks. Fixing a flaw is an important first step, but making sure attackers are gone is just as vital.