Cisco SD-WAN Flaw Let Chinese-Linked Hackers Steal Encryption Keys

Patching a hole doesn't automatically undo what walked through it while it was open. Cisco's networking customers are learning that the hard way this week, after researchers found a piece of malware that had been quietly copying encryption keys off their SD-WAN controllers for months.

A flaw that was already fixed — mostly

The bug at the center of this, tracked as CVE-2026-20127, lives in Cisco's Catalyst SD-WAN controllers — the boxes that manage encrypted network links between a company's branch offices, data centres, and cloud services. It's an authentication bypass, meaning an attacker could get administrator-level control without ever needing a password. Cisco rated it a perfect 10.0 on the CVSS scale, the industry's standard 1-to-10 severity score, which is about as bad as a vulnerability gets.

Cisco shipped a fix back in February 2026. The problem is that the flaw was already being used in the wild before that patch existed, and — according to new research from Cisco's own Talos threat intelligence team, published on October 28 — some attackers kept exploiting unpatched boxes well after the fix was available. That gap, between "a patch exists" and "everyone actually installed it," is where most real-world damage happens.

KeyDrift: malware that hides inside the process doing the encrypting

Talos is tracking the group behind this as UAT-11473, an internal label it uses until an actor earns a more permanent name. What makes this campaign notable isn't just the entry point — it's what they left behind: a multi-part implant Talos has named KeyDrift.

KeyDrift doesn't try to break the encryption protecting SD-WAN traffic. It's cleverer than that. It embeds itself inside vdaemon, the legitimate Cisco process that already handles those encrypted control sessions, and simply reads the keys at the moment the controller itself decrypts them. From the network's point of view, nothing looks wrong — the process doing the "spying" is the same trusted process that's supposed to be there.

A patch closes the door an attacker used to get in. It does nothing about what they already copied on their way through.

The Volt Typhoon connection

Talos says it has high confidence that UAT-11473's infrastructure overlaps with something researchers call "Silent Train" — a relay network built from hacked home and small-office routers, first documented separately by Lumen's Black Lotus Labs as belonging to Volt Typhoon, a state-linked Chinese hacking group long associated with quietly burrowing into power grids, water utilities, and telecom networks rather than causing immediate, visible damage. Lumen's own data suggests Volt Typhoon had been exploiting this exact Cisco flaw since late 2025. Talos is careful to say "overlap," not "same group" — attribution in cases like this rarely comes with a signed confession, and multiple actors sometimes share infrastructure.

Whoever's actually behind the keyboard, the goal lines up with a well-worn pattern: get inside, stay quiet, and collect material — in this case, the very keys meant to keep network traffic private — for as long as possible before anyone notices.

What this means if you run Cisco SD-WAN gear

Security teams dealing with this can't treat it as a routine patch-and-move-on situation, because stolen keys remain useful to an attacker even after the hole they came through is closed. Recommended steps circulating among researchers include:

• Confirm every Catalyst SD-WAN controller is running the February 2026 patch or later — not just scheduled for it
• Rotate encryption keys and certificates on affected controllers, since the patch alone doesn't invalidate anything already stolen
• Audit logs around the vdaemon process for unexplained activity going back to early 2025
• Treat any controller that was ever unpatched and internet-facing as potentially compromised, not just potentially vulnerable

There's a genuine India angle here too, and it's not a small one. Cisco's SD-WAN stack is widely deployed across Indian banks, IT services firms, and large enterprises to link branch offices back to central data centres — exactly the kind of setup this flaw targets. CERT-In, India's government cybersecurity response agency, has a track record of issuing its own advisories within days of a major CISA or vendor disclosure like this one, and organisations here shouldn't wait for that local notice before checking their own exposure. There's also recent history that makes the Chinese-state angle feel less like a distant headline: Indian power grid systems were previously targeted by a China-linked group in a widely reported 2020-21 campaign, so the idea of state-backed actors probing network infrastructure connected to Indian critical systems isn't hypothetical.

The more interesting long-term lesson is about what "fixed" actually means. A CVE getting a patch tells you the door is closed; it tells you nothing about who already walked through it, or what they picked up on their way out. As encrypted infrastructure becomes the default rather than the exception, attackers are increasingly going after the keys themselves rather than trying to break the math protecting them — and that's a much harder kind of theft to detect, because nothing about the encryption itself ever looks broken.