Apt
Security incidents tagged Apt. Newest first.
1 Apt incident in the last 12 months
- Incidents
- 1
- Live
- 1
- Patched
- 1
- Days without an incident
- 1
- Longest quiet run: 133 days (Jun 17–Oct 27)
- Patched
KeyDrift malware steals SD-WAN encryption keys from Cisco Catalyst SD-WAN controllers hacked through CVE-2026-20127
Cisco Talos said on Oct 28 2026 that an APT it tracks as UAT-11473 exploited CVE-2026-20127, the CVSS 10.0 authentication bypass in Cisco Catalyst SD-WAN Controller, Manager and Validator that Cisco fixed in February, and installed a custom malware framework called KeyDrift. Its PolyFlame module is injected into the controller's vdaemon processes as an in-memory backdoor and relay, and its LittleFilch module hooks SSL_read to pull AES-256 key material for a preset list of edge routers out of decrypted control traffic, staging it encrypted for exfiltration. Talos calls the activity historical, says targets included space and satellite services, defense and aerospace technology and policy research, and assesses with high confidence that the group's infrastructure overlaps with Volt Typhoon's Silent Train covert network. There is no workaround; upgrade to a fixed release and check controllers for compromise.
Cisco Catalyst SD-WAN Controller, Manager and ValidatorSince Oct 28, 2026
