# Hackers target Cisco SD-WAN controllers with key-stealing malware

_Published Thursday, October 29, 2026 at 2:48 PM EDT · Security · Latest · Tier 2 — Notable_

![Hackers target Cisco SD-WAN controllers with key-stealing malware — Primary](https://www.bleepstatic.com/content/hl-images/2026/10/14/Cisco.jpg)

Cisco Talos researchers have identified a threat group exploiting a patched Cisco SD-WAN authentication flaw to deploy KeyDrift, BleepingComputer reports. The observed attacks targeted space and satellite services, defense and aerospace technology, and policy research organizations.

Talos assesses that the malware maintains persistent access inside controller processes, intercepts decrypted control traffic and extracts cryptographic key material. One component encrypts collected information before transmitting it to attackers. Cisco patched the exploited flaw, CVE-2026-20127, in February 2026 and recommends applying available updates and its hardening guidance. Researchers see overlap with Volt Typhoon's Silent Train network but have made no definitive attribution.

## Sources

- [BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-exploit-cisco-sd-wan-flaw-to-deploy-custom-keydrift-malware/)

---
Canonical: https://techandbusiness.org/newswire/iC17MNDnD62jUuqHm5mcJY
Published: 2026-10-29T18:48:08.492Z
Story chronology: 2026-10-29T18:38:26.000Z
Retrieved: 2026-10-29T22:43:39.343Z
Publisher: Tech & Business (techandbusiness.org)