CADChain Blog
2026-11-04 13:25 News

Cisco SD-WAN Espionage: KeyDrift Malware Built to Steal Network Encryption Keys Targeted Defence, Aerospace and Satellite Firms. What Engineering Companies Should Do Now | CADChain | CAD DRM & IP

On 28 October 2026, Cisco Talos published its analysis of KeyDrift, a malware framework that a highly sophisticated hacking group it tracks as UAT-11473 planted on Cisco Catalyst SD-WAN controllers. The malware was built to sit inside the controller software for a long time and copy the encryption keys that protect traffic between company sites. Talos saw the group target space and satellite services, defence and aerospace technology, and policy research organisations, and says its infrastructure overlaps considerably with the China-linked group Volt Typhoon.
SD-WAN controllers are the boxes that tell a company's routers how to connect head office, design centres, factories and data centres, and they hand out the keys for the encrypted tunnels between them. The attackers got in through CVE-2026-20127, a maximum-severity flaw that Cisco disclosed in February 2026 and patched. On the same day, 28 October, Cisco updated its advisory with a link to the Talos report, and Lumen's Black Lotus Labs, in a report covered on 29 October, described how Volt Typhoon had exploited the same flaw by late 2025 and kept exploiting it after the February disclosure.
The lesson goes beyond one Cisco product. Many engineering companies treat the encrypted tunnel as the protection for CAD models moving between sites. KeyDrift shows what happens when the box that holds those keys is compromised. Below: what Talos found, who is exposed, what to check this week, and why design files need protection that does not depend on the network.
TL;DR: spies went after the keys to the network, not just the data

Cisco Talos says UAT-11473 used a critical Cisco Catalyst SD-WAN flaw (CVE-2026-20127, CVSS 10.0) to install KeyDrift, which hides in controller processes and collects what Talos assesses to be AES-256 IPsec key material. Targets included defence and aerospace technology and space and satellite services. Talos did not report how much data was taken or name victims. Cisco has fixes and says no workaround fixes the flaw. Lesson: patch and hunt on SD-WAN controllers now, and keep design files encrypted at file level so a tunnel key is never the only thing between an attacker and your CAD data.

What did Cisco Talos find?

In a technical report published on 28 October 2026, Talos analysed what it calls historical activity by UAT-11473, a highly sophisticated threat actor. The group broke into Catalyst SD-WAN controllers and installed a custom toolkit that Talos named KeyDrift. Talos describes it as “designed to provide long-term persistent access and automated exfiltration of sensitive keying material.”
  • Targets: space and satellite services, defence and aerospace technology, and policy research organisations. Talos did not name victims, countries or a victim count.
  • Way in: CVE-2026-20127, an authentication bypass in Cisco Catalyst SD-WAN Controller, Manager and Validator that gives an unauthenticated remote attacker access through an internal, highly privileged account.
  • What it collects: a 32-byte value that Talos assesses to be AES-256 IPsec key material distributed by the controller, plus the addresses of the devices it belongs to.
  • How it hides: in memory inside a legitimate controller process, with commands carried in normal SD-WAN control traffic.
  • Who is behind it: Talos assesses with high confidence that the group's operating infrastructure overlaps considerably with Volt Typhoon's covert relay network, while noting that shared infrastructure alone does not prove both names refer to the same actor.
Talos could not recover the configuration file that holds the exfiltration addresses, so the destination of the key material is unknown, and it did not say how many organisations were hit or how much data left them. The findings point to targeted key harvesting, not proof that attackers decrypted all traffic they may have captured. None of the samples contained hardcoded addresses or domains, so blocklists help little.

How did the KeyDrift attack work?

Talos describes a chain of small, purpose-built parts. After the authentication bypass, the attackers changed the controller's start-up scripts so their code would load after every restart, behind a loader disguised as a normal system component. An injector then placed two libraries into vdaemon, the controller process that handles the encrypted control connections to every router in the network.
The first library, which Talos calls PolyFlame, is a backdoor: it runs commands, moves files and can relay orders from one controller to its peers, so a single foothold can reach other controllers in the same network. It can also read what vdaemon knows, including session keys, the network map, routes and policies. The second library, LittleFilch, reads decrypted control messages as they arrive and pulls out the tunnel key material and addresses. It encrypts each record and stores it in a temporary file, ready to be sent out over UDP in packets that look like normal encrypted traffic.

Why do stolen SD-WAN keys matter for design data?

In many engineering companies, CAD models, drawings and PDM vault replication travel between design office, plant and data centre over the SD-WAN, and the IPsec tunnel keeps that traffic private. If an attacker has the tunnel keys and can also capture the traffic, for example through a compromised telecom provider or router along the path, the tunnel no longer protects what passes through it.
Talos did not show that this happened at scale, and keys alone are not enough: an attacker also needs the traffic. But telecoms and network providers are among the favourite targets of Volt Typhoon-linked operations, and the controller knows every site, route and policy. Lumen sums up why these systems are prized: “Management and control plane technologies provide broad visibility”.
VPNs, TLS and IPsec protect data only while it moves, and only while the devices holding the keys stay safe. Once a file arrives, or an attacker sits on a network box or a logged-in account, it is readable again. Our guide to CAD encryption at rest, in transit and in use explains where each layer stops, and our comparison of file-level DRM and folder-level security shows why protection that travels with the file closes that gap.
Encryption layerWhat it protectsWhere the keys liveWhat happens if the key holder is compromised
SD-WAN or VPN tunnel (IPsec)Traffic between sites while it travelsSD-WAN controllers and edge routersCaptured traffic can be decrypted; KeyDrift targeted exactly these keys
TLS to PLM, PDM or cloud appsSessions between a user and a serverServers, load balancers, certificate authoritiesAttacker on the server sees files in clear; stolen certificates allow impersonation
Disk or server encryptionData on stolen disks or snapshotsThe server or storage systemFiles are readable to anyone logged in to the running system
File-level encryption with access policiesEach CAD file, wherever it is copiedA separate key and policy service, per file and per userA copied file stays unreadable without a granted, logged permission

Who is exposed?

Beyond the sectors Talos named, Lumen's Black Lotus Labs, in its report on the Volt Typhoon relay network called Silent Train, lists telecom providers, government agencies, defence contractors, satellite and emergency communications firms, IT service providers and critical infrastructure from energy to aviation. Lumen says it sent hundreds of victim notifications over three years.
This is the same target profile as in our recent reports on APT28's campaign against a NATO shipbuilder and an aircraft engine maker and on China-linked hackers using the ARTEX AI agent framework, and in our overview of CAD theft tactics. Suppliers to aerospace and defence primes often hold the same drawings and models as their customers with a fraction of the security budget; our guide to aerospace CAD file security for defence contractors covers the requirements they already face.
Companies that do not run Cisco SD-WAN are not off the hook. Lumen links the same relay network to at least four confirmed zero-days in central management products, including Versa Director, N-able N-Central and VeloCloud Orchestrator. The pattern is the target: whatever box manages many other boxes.

What happened before the Talos report?

Cisco first published its advisory for CVE-2026-20127 on 25 February 2026, saying it was aware of limited exploitation. The same day, the US cybersecurity agency CISA issued Emergency Directive 26-03, which ordered federal civilian agencies to inventory their Cisco SD-WAN systems, collect forensic data and patch by 27 February, and partner agencies in Australia, Canada, New Zealand and the UK issued warnings and a joint hunting guide. In March, Cisco said two further SD-WAN Manager flaws, CVE-2026-20122 and CVE-2026-20128, were also being exploited. In June, it added the SD-WAN Validator to the list of affected products.
According to Lumen, Volt Typhoon's operators were exploiting the flaw by late 2025 and continued after the February disclosure. A patch closes the door; it does not remove an implant already inside, which is why Talos and Cisco stress hunting for traces.

What should SD-WAN owners check now?

Cisco says there is no workaround that fixes the flaw. Based on the advisory and the Talos report, network teams should:
  • Patch to a fixed release. Cisco lists 20.9.8.2, 20.12.5.3 or 20.12.6.1, 20.15.4.2 and 20.18.2.1 depending on the branch; releases older than 20.9 must migrate, and several branches are out of maintenance.
  • Limit who can reach the controllers. Until patched, Cisco's temporary mitigation is to restrict ports 22 and 830 to known controllers and trusted addresses.
  • Look for unauthorised logins. Check /var/log/auth.log for unexpected public-key logins to the vmanage-admin account, and compare control-plane peering events with your documented topology and maintenance windows.
  • Hunt for KeyDrift traces. Talos lists altered runit launch scripts, unexpected libraries in the vdaemon process, a suspicious aaamgrd executable and collection files such as /var/tmp/vdaemon.bin, and has published detection rules.
  • Assume keys may be known. If a controller was compromised, treat the tunnel keys and any credentials stored on it as exposed, and plan a rebuild and re-key with Cisco support rather than only a patch.

What does this mean for European companies?

The EU Trade Secrets Directive protects design data only when its owner took reasonable steps to keep it secret, and relying on one network layer is a weak story to tell a judge. Our guide to trade secrets for deep-tech startups explains the tests, and audit trail requirements for IP litigation covers the records that help prove what happened.
Network equipment is also in scope of Europe's cyber rules. Manufacturers of products with digital elements already have to report actively exploited vulnerabilities and severe incidents under the Cyber Resilience Act, as our article on Cyber Resilience Act reporting explains, and many operators and their suppliers have incident duties under NIS2. A compromised controller in a factory network may trigger those clocks.
Do not let a network key decide who reads your designs. CADChain encrypts CAD files at file level and controls who can open them, across CAD systems, partners and suppliers, with access logs and blockchain proof of ownership.

👉 Protect your CAD files with CADChain

What should engineering companies do now?

  1. Ask IT one question this week. Which central management systems run our network, VPN, endpoints and remote access, are they patched, and has anyone hunted for compromise since February?
  2. Map how design data travels. List which links carry CAD models, drawings and PDM replication between offices, plants, data centres and suppliers, and which network devices hold the keys for them.
  3. Take management interfaces off the internet. Controllers, PLM and PDM admin consoles and licence servers should only be reachable from trusted networks with MFA.
  4. Encrypt design files at file level. A file that is encrypted on its own stays protected on a compromised network, a hacked server or a supplier's laptop. Our article on zero trust for CAD file distribution shows how to stop trusting the network.
  5. Control and watch supplier access. Share only what a partner needs, with expiry dates, and monitor access in real time; see our guides to CAD file security in supply chain collaboration and real-time CAD access monitoring.
  6. Keep dated proof of your designs. Timestamped records of what you created and when help in disputes after a leak and show reasonable steps. Our complete guide to CAD file security covers vaults, cloud storage and suppliers.

How does this fit the bigger picture?

Our sister sites covered other pressure on keys, files and creative work this week.

Conclusion

KeyDrift shows that capable spies do not always go straight for the files. Sometimes they go for the system that holds the keys to everything else and wait inside it. Talos did not report which organisations were hit, but the toolkit's purpose is clear, and its targets design satellites, aircraft and defence systems.
For engineering teams the answer has two parts. Network owners need to patch, hunt and re-key their SD-WAN and other management systems now. Design data owners need protection that does not depend on any single network box: files that are encrypted on their own, opened only by people with a granted and logged permission, and backed by dated proof of who created them.
Protect the file, not only the tunnel. CADChain gives engineering teams file-level encryption, per-file permissions, access logs and blockchain proof of ownership for CAD files, so a stolen network key does not open your designs.

👉 See how CADChain protects CAD files

FAQ: KeyDrift and Cisco SD-WAN espionage

What is KeyDrift?

KeyDrift is a malware framework found by Cisco Talos on Cisco Catalyst SD-WAN controllers. It gives attackers a hidden backdoor inside the controller software and collects key material for the encrypted IPsec tunnels between company sites. Talos published its analysis on 28 October 2026.

Who is UAT-11473?

UAT-11473 is the name Cisco Talos uses for a highly sophisticated hacking group. Talos assesses with high confidence that its infrastructure overlaps considerably with the covert relay network of Volt Typhoon, a China-linked group, but says that overlap alone does not prove they are the same actor.

Which vulnerability did the attackers use?

CVE-2026-20127, an authentication bypass rated CVSS 10.0 in Cisco Catalyst SD-WAN Controller, Manager and Validator. Cisco disclosed it on 25 February 2026, has released fixed versions and says no workaround fixes it.

Was data stolen?

Talos describes tools built to collect and send out encryption key material, but it did not name victims, report data volumes or show that attackers decrypted captured traffic at scale. The exfiltration destination is unknown.

We patched in February. Are we safe?

Not necessarily. Exploitation was under way by late 2025, so a controller may have been compromised before the patch. Check for the traces Talos and Cisco list and work with Cisco support if you find any.

How does CADChain help?

CADChain encrypts CAD files at file level, applies per-file permissions, logs access and timestamps files on a blockchain, so a design copied from a network, server or partner stays unreadable without permission and ownership can be proven. It does not replace patching, network monitoring or legal advice.