Cybersecurity experts have uncovered that hackers leveraged a serious flaw in Cisco’s Catalyst SD-WAN to introduce malware into network control systems. This breach, first identified in February, allowed for the installation of a malicious program known as KeyDrift, which is designed to extract encryption keys used for securing data traffic.
Details of the Exploited Vulnerability
The vulnerability, identified as CVE-2026-20127 with a critical severity score of 10.0, permitted unauthorized remote attackers to bypass security protocols and gain administrative control over affected systems. The attackers could use these privileges to log in as high-level internal users, although not with root access. Cisco’s Talos team reported these incidents without specifying the exact timeline of the attacks.
This flaw affected the Cisco Catalyst SD-WAN Controller, among other components, allowing attackers to manipulate key exchanges integral to secure network communications. The flaw’s exploitation was correlated with activity tracked by Talos as UAT-8616, dating back to at least 2023.
The Mechanism of KeyDrift Malware
KeyDrift primarily infiltrates systems through altered scripts that manage service launches in Cisco SD-WAN devices. The malware, once inside, can act as a backdoor, executing commands and transmitting sensitive data to external servers. A notable component called LittleFilch intercepts decrypted control messages, extracting key material and encrypting it for potential offsite transmission.
Talos linked the infrastructure of the cyber group behind KeyDrift with another known entity, Silent Train, which has connections to broader networks of compromised devices. While the overlap suggests possible connections to the Chinese state-sponsored group Volt Typhoon, definitive links between these entities remain unconfirmed.
Response and Mitigation Strategies
Cisco has addressed the vulnerability with several software updates, urging users to migrate to these fixed releases. The company has also provided guidance on network hardening to reduce attack risks. However, these measures do not remove existing malware from compromised systems.
For those unable to immediately update, Cisco recommends restricting access to certain network ports as a temporary safeguard. Organizations are also advised to monitor for suspicious activity and seek assistance from Cisco’s Technical Assistance Center if needed.
Future Outlook and Recommendations
The discovery of this exploit underscores the ongoing challenges in maintaining network security in the face of sophisticated cyber threats. Organizations using Cisco’s SD-WAN solutions should prioritize implementing the latest security patches and continuously monitor their systems for signs of compromise.
As cyber threats evolve, staying informed and proactive in applying security measures is crucial. The collaboration between industry experts and organizations is essential to mitigate risks and protect sensitive information from being compromised.
