A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a…

Hackers exploited Cisco SD-WAN zero-day CVE-2026-20127 to deploy KeyDrift malware, steal encryption keys, and gain admin access.

A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift. [...]

State-sponsored threat actors are compromising critical enterprise network infrastructure. Specifically, operators tracking as UAT-11473 breached Cisco Catalyst SD-WAN controllers across strategic industries. Intruders deployed a sophisticated in-memory malware suite dubbed KeyDrift into active system processes. This espionage campaign compromised satellite operators, aerospace manufacturers, defense contractors, and geopolitical think tanks. Furthermore, the malware extracts cryptographic keys directly from decrypted control streams.

Cisco Catalyst SD-WANの制御システムに入り込み暗号鍵に関わる情報を収集する専用マルウェア群「KeyDrift」の構造をCisco Talosが公開した。宇宙・防衛・政策研究に関わる組織が標的になっている。

Talos has identified UAT-11473, a highly sophisticated APT, who exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances to bypass authentication…

A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a c...

China-linked hackers implanted custom malware inside SD-WAN controllers to siphon AES keys protecting encrypted traffic between sites.

A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift.

A state-linked hacking group used a maximum-severity Cisco SD-WAN zero-day flaw to break into network controllers and install a custom malware framework called KeyDrift. The flaw is CVE-2026-20127. I…

A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift. [...]

Hackers exploited Cisco SD-WAN flaw CVE-2026-20127 to deploy KeyDrift malware, harvest encryption key material and maintain access to compromised network controllers.

Cisco Talos reports that UAT-11473 exploited CVE-2026-20127 to deploy KeyDrift on Cisco SD-WAN controllers. The framework can intercept control traffic and…