Cisco Talos says hackers used a maximum-severity Cisco flaw to plant malware that copies the keys protecting traffic between company sites.
Hackers broke into the systems that run some companies' private networks and planted malware that copies the digital keys locking up their data. Cisco Talos, Cisco's security research team, reported this on October 28. The flaw they used was fixed in February, but patching may not clear out malware that is already inside.
The flaw is tracked as CVE-2026-20127 and scores 10.0 out of 10 for severity. It lets an attacker with no login get administrator access to Cisco Catalyst SD-WAN control systems. SD-WAN is software that links a company's offices and sites over the internet.
Hackers used it to install custom malware called KeyDrift. It is built to copy the keys that encrypt traffic between sites and store them for later use. Talos calls the attacks historical. It does not say when they happened or whether any stolen keys were actually sent out.
The flaw affects the Catalyst SD-WAN Controller, Manager and Validator, whatever their settings. That covers systems a company runs itself and Cisco's hosted cloud versions, including the Cisco Managed and FedRAMP environments. Cisco added the Validator to its advisory on June 16.
If your business does not use Cisco SD-WAN, this does not touch you directly. The group behind KeyDrift has gone after space and satellite services, defense and aerospace technology, and policy research. Cisco says it knows of limited exploitation.
There is no workaround. Until an upgrade is possible, on-premises customers can limit access to two network ports, 22 and 830. That will not remove malware already on a device. Releases earlier than 20.9, and the 20.11, 20.13, 20.14 and 20.16 trains, have reached end of software maintenance.
Talos does not say whether upgrading removes KeyDrift from a hacked device, or whether any keys should be replaced. Cisco's February guide warns that exploits from before an upgrade could still be in place.
Talos tracks the group as UAT-11473. Its infrastructure overlaps considerably with Silent Train, a network of hacked small-office, home-office, IoT and business devices. Lumen says Volt Typhoon used that network to hide its activity. CISA, the NSA and the FBI said in 2024 that Volt Typhoon is a Chinese state-sponsored group.
Talos links the two only through that shared infrastructure. It does not say they are the same group. Separately, Lumen said Volt Typhoon was exploiting this flaw by late 2025 and kept doing so after February. Lumen does not tie that to KeyDrift.
The alert box above lists the steps. Security teams can also use the Snort detection rules Talos released on October 28. If you find signs of a break-in, treat it as an incident and contact Cisco's support team.
If you run Cisco SD-WAN, upgrade and also check for signs of a past break-in, because the fix may not remove KeyDrift from a system already hit.
Morristown police say scammers posing as bank staff are pushing people to withdraw cash, which is very hard to get back once it is handed over.
Read more: Morristown police warn of scam where fake bank staff ask for cashA viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youA message saying your Amazon account was hacked is often the scam itself. Checking in the Amazon app first can protect your card, gift balance and phone.
Read more: If Amazon says your account was hacked, check before you call
