Attackers exploited Cisco SD-WAN controllers to gain privileged access and deploy malware built for persistence and key theft. The KeyDrift framework operated inside legitimate control-plane processes, intercepted decrypted traffic and collected material believed to protect data-plane communications. The campaign targeted space, satellite, defense, aerospace and policy organizations. Its infrastructure overlapped significantly with a covert network used by Volt Typhoon, but researchers did not conclude that the operators were the same group.
What Happened
A threat cluster exploited a critical authentication-bypass weakness in Cisco Catalyst SD-WAN controller components and deployed a custom malware framework called KeyDrift. The weakness allowed remote attackers without credentials to bypass peering authentication, obtain administrative rights and potentially alter the SD-WAN configuration. Cisco patched it in February 2026, after it had already been used as a zero-day.
KeyDrift was designed to operate inside legitimate SD-WAN control-plane processes. Its PolyFlame component acted as a backdoor, supported command execution and file transfer, and could relay communications between an attacker’s command infrastructure and other hosts. A second component, LittleFilch, intercepted control-session traffic after decryption and collected information believed to include cryptographic material protecting data-plane traffic.
The malware used modified service startup scripts and process injection to maintain access. Collected information was protected, staged and transmitted to the attackers. Researchers also saw indications that the framework continued to evolve, including changes intended to complicate analysis and variations in process impersonation.
The observed targets included organizations involved in space and satellite services, defense and aerospace technology, and policy research. Infrastructure used by the threat cluster overlapped considerably with Silent Train, a covert access network associated with Volt Typhoon. Researchers assessed the overlap with high confidence but did not state that the two tracked groups were identical.
Separate research into Silent Train described a broader pattern of targeting management and control-plane platforms. The network had supported confirmed zero-day campaigns against several products and routed activity through chains of compromised routers, connected devices and enterprise systems.
Why It Matters
SD-WAN controllers are not ordinary endpoints. They help govern network relationships, configuration and traffic across multiple systems. Administrative control over a controller can therefore provide an attacker with broad visibility and the ability to change how the environment operates.
KeyDrift raises the stakes because it was built to live inside trusted control-plane processes and inspect traffic after decryption. The collection of material believed to protect data-plane communications could undermine confidence in communications that defenders expect the network fabric to secure.
The targeting also matters. Space, satellite, defense, aerospace, telecommunications, government and critical infrastructure organizations can hold information or provide capabilities relevant to a geopolitical crisis. The available reporting described the activity as a combination of espionage and possible pre-positioning, although the precise intent behind each compromise cannot be established from the evidence supplied.
For business and security leaders, the durable risk is hidden strategic access. A controller can be patched while malicious persistence, stolen keys or unauthorized peers remain. Recovery therefore requires investigation and validation, not only software maintenance.
What to Watch
Organizations should watch for further clarification of when the observed KeyDrift compromises occurred and how widely the malware was deployed. The activity was described as historical, but no exact attack period was provided for the specific threat cluster.
The relationship between the cluster and Volt Typhoon also remains an assessment rather than a confirmed identity match. Infrastructure overlap is meaningful, but defenders should base detection and response on behavior and evidence in their own environments rather than attribution alone.
Potential indicators include altered service startup scripts, unexpected activity inside legitimate controller processes, rogue peers, unexplained access to keying material and unusual outbound communications. If those signs appear, organizations should treat the controller as potentially compromised even if the security update is present.
Continued development of KeyDrift or additional campaigns against management platforms would reinforce the broader pattern of attackers seeking systems that provide wide control with limited visibility.
What Defenders Should Do
Patch and verify: Apply the available Cisco update to affected SD-WAN Controller and Manager systems, and confirm the running software state after maintenance. Use the vendor’s dedicated hardening guidance to review the deployment rather than treating the patch as the only required control.
Investigate persistence: Examine controllers for modified service startup scripts, unfamiliar process injection, rogue peers and unexpected file or command activity. Review the staging path identified in the reporting and investigate unexplained outbound UDP traffic where relevant to the affected environment.
Protect management access: Limit administrative reachability, require trusted paths to controller interfaces and review who can change peering or configuration. Management platforms should receive monitoring and access controls comparable to other high-value administrative systems.
Validate trust: If compromise is suspected, assess whether keying material, configuration or administrative credentials may have been exposed. Do not assume that removing malware restores trust in previously accessed secrets or network relationships.
Hunt beyond the device: Because the controller can relay commands and influence other hosts, review connected systems and management activity for follow-on access. Preserve evidence before rebuilding or making changes that could remove useful traces.
The Larger Lesson
Attackers are increasingly interested in the systems that manage other systems. A control-plane platform can provide reach, persistence and visibility that would otherwise require compromising many separate endpoints.
This campaign also shows why trusted network infrastructure cannot be treated as passive plumbing. Controllers process sensitive relationships and decrypted control traffic, making them attractive intelligence targets. Security programs should place management platforms, identity systems and other control planes in the same high-value category, with strict exposure controls, rapid patching and dedicated compromise assessment.