Hackers target Cisco SD-WAN controllers with key-stealing malware

Cisco Talos researchers have identified a threat group exploiting a patched Cisco SD-WAN authentication flaw to deploy KeyDrift, BleepingComputer reports. The observed attacks targeted space and satellite services, defense and aerospace technology, and policy research organizations. Talos assesses that the malware maintains persistent access inside controller processes, intercepts decrypted control traffic and extracts cryptographic key material. One component encrypts collected information before transmitting it to attackers. Cisco patched the exploited flaw, CVE-2026-20127, in February 2026 and recommends applying available updates and its hardening guidance. Researchers see overlap with Volt Typhoon's Silent Train network but have made no definitive attribution.