Hackers Exploit Cisco SD-WAN Flaw to Deploy Custom KeyDrift Malware
A newly tracked APT group, UAT-11473, is exploiting the CVE-2026-20127 authentication-bypass flaw in Cisco SD-WAN Controllers to deploy the KeyDrift malware.
Cybersecurity researchers have uncovered a new advanced persistent threat group tracked as UAT-11473, which is actively exploiting a critical vulnerability in Cisco Catalyst SD-WAN infrastructure to deploy a custom malware framework named KeyDrift.
The attacks leverage CVE-2026-20127, an authentication-bypass flaw affecting Cisco SD-WAN Controllers. By exploiting this vulnerability, threat actors manage to bypass security controls and inject the malicious KeyDrift framework into target networks.
According to threat intelligence reports, KeyDrift is designed with sophisticated capabilities aimed at maintaining persistence and covertly operating within enterprise environments. The UAT-11473 campaign highlights the growing focus of attackers on enterprise network edges.
This incident serves as a stark reminder of the critical need for organizations to patch network infrastructure devices promptly. SD-WAN controllers are high-value targets, and vulnerabilities in these systems can lead to severe network compromises.
As organizations worldwide continue to adopt software-defined networking, security teams must remain vigilant against sophisticated APT campaigns targeting infrastructure devices, ensuring regular updates and continuous monitoring are in place.
