Security · Updated 29 Oct, 01:54 pm IST
Hackers used Cisco SD‑WAN flaw to install KeyDrift malware stealing encryption keys
Why it matters for readers: It shows attackers can target the systems that distribute encryption keys, not just the devices that use them, to read protected traffic.
- The flaw is tracked as CVE-2026-20127, has a CVSS score of 10.0, and lets an unauthenticated remote attacker bypass authentication to gain administrative privileges on controllers.1
- Attackers installed custom malware called KeyDrift that hooks into the controller process vdaemon to read decrypted control messages and extract AES key material.1
- A KeyDrift component named LittleFilch targets a preset list of edge routers, pulling their IP addresses and a 32‑byte field assessed by Talos as AES‑256 key material.1
- Cisco disclosed and fixed the vulnerability in February, while Talos says the cluster of activity (UAT-8616) goes back to at least 2023.1
Get a brief like this every morning
Uzha reads hundreds of sources and gives you the stories that matter for your work, with every source linked. Free.
Get started