Cisco Talos describes a newly identified advanced threat group, UAT-11473, exploiting CVE-2026-20127 in Cisco Catalyst SD-WAN controllers to install the KeyDrift malware framework, BleepingComputer reports. The maximum-severity flaw allows authentication bypass and was patched in February 2026. KeyDrift runs inside the controller's processes, intercepts control traffic after decryption and extracts IPsec encryption keys. The attacks targeted space services, defence, aerospace and policy research organisations, and the group appears linked to infrastructure used by China's Volt Typhoon.

What it means: SD-WAN systems connect a company's offices, shops and data centres, and the controller is the point that hands out keys and rules across the whole network. Whoever controls that point can in practice read encrypted traffic between sites or add their own devices to the network. The fact that the flaw was patched eight months ago and is still being exploited shows many organisations have not updated their network equipment, which often runs with nobody watching it. Moreover, installing the update is not enough if the attacker is already inside, because the malware may persist and the keys may already be stolen. For Greek businesses and bodies with multi-site networks, such as banks, retail chains and service providers, the controllers' versions need checking, along with a search for signs of compromise following Cisco's guidance and, if there is any suspicion, rotation of all keys. The targets in defence and space point to espionage rather than financial motives. Cisco also advises applying its own hardening guide for Catalyst SD-WAN systems.

Read the original on BleepingComputer

Related service: Custom software

Related stories