Xakerlar fevral oyida tuzatilgan Cisco Catalyst SD-WAN’dagi muhim zaiflikdan foydalanib, tashkilotning SD-WAN tarmog‘ini boshqaradigan tizimlarga maxsus zararli dastur o‘rnatdi.
KeyDrift deb nomlangan bu zararli dastur, saytlar o‘rtasidagi trafikni shifrlaydigan kalitlarni nusxalab, keyinchalik foydalanish uchun saqlashga mo‘ljallangan, deb xabar berdi Cisco Talos 28-oktabrda. Talos hujumlarni tarixiy deb ataydi, lekin ular qachon sodir bo‘lganini yoki biror kalit yuborilganini aniqlamaydi.
Zaiflik CVE-2026-20127 deb kuzatiladi va CVSS balli 10.0. U autentifikatsiyadan o‘tmagan masofaviy hujumchiga autentifikatsiyani chetlab o‘tish va bu boshqaruv tizimlarida ma’muriy huquqlarni qo‘lga kiritish imkonini beradi. Controller’da hujumchi root bo‘lmagan yuqori huquqli ichki hisob sifatida tizimga kirishi mumkin.
Cisco fevral oyida zaiflikni e’lon qilganida, Talos uning ekspluatatsiyasini UAT-8616 deb kuzatgan — bu faoliyat klasteri kamida 2023-yildan beri davom etayotganini aytgan.
Cisco’ning an’anaviy kalit almashinuvida har bir SD-WAN router o‘z trafikiga AES kalitini vaqti-vaqti bilan yaratadi va uni Catalyst SD-WAN Controller’ga (avval vSmart) yuboradi. Controller kalitlarni boshqa routerlarga o‘tkazadi. Controller’dagi vdaemon deb nomlangan jarayon bu kalitlarni tashiydigan shifrlangan boshqaruv ulanishlarini ishga tushiradi.
Buzilgan Controller’da KeyDrift komponenti LittleFilch vdaemon’ga ulanadi va shifrlangan boshqaruv xabarlarini shifrlangandan keyin o‘qiydi. Oldindan belgilangan chekka routerlar ro‘yxati uchun u ularning IP manzillarini va 32 baytli maydonni ajratib oladi. Talos bu maydonni Controller routerlar o‘rtasida o‘tkazadigan AES-256 kalit materiali deb baholaydi.
LittleFilch to‘plagan ma’lumotlarni RSA bilan shifrlaydi va faylga yozadi. Keyin u bu ma’lumotlarni sozlamalar faylida ko‘rsatilgan manzilga UDP orqali yuborishi mumkin, bu faylni o‘qib bo‘lgach o‘chirib tashlaydi. Talos bu sozlamalar faylini tiklay olmadi.
Talos UAT-11473 deb kuzatadigan KeyDrift ortidagi guruh kosmik va sun’iy yo‘ldosh xizmatlari, mudofaa va aerokosmik texnologiya, hamda siyosat tadqiqotlarini nishonga olgan.
Guruh infratuzilmasi Silent Train bilan “jiddiy darajada mos keladi”, deb Talos yuqori ishonch bilan baholaydi. Silent Train — Lumen’ning Black Lotus Labs’i buzilgan kichik ofis, uy, IoT va biznes qurilmalari tarmog‘iga bergan nom.
Lumen Volt Typhoon bu tarmoqdan o‘z faoliyatini yashirish uchun foydalanganini aytadi. CISA, NSA va FBI 2024-yilda Volt Typhoon Xitoy davlat homiyligidagi kiber guruh ekanini aytgan.
Talos UAT-11473’ni Volt Typhoon bilan faqat infratuzilma mosligi orqali bog‘laydi. U ikki guruh bir xil ekanini yoki UAT-11473 fevral oyida e’lon qilingan UAT-8616 klasteri bilan qanday bog‘liqligini aytmaydi.
Alohida, Lumen 28-oktabrda Volt Typhoon 2025-yil oxiriga kelib CVE-2026-20127’dan foydalanayotganini va Cisco fevral oyida zaiflikni e’lon qilganidan keyin ham ekspluatatsiyani davom ettirganini aytdi. Lumen bu faoliyatni KeyDrift bilan bog‘lamaydi.
Talos ma’lumotiga ko‘ra, KeyDrift asosan Cisco SD-WAN qurilmalari o‘z xizmatlarini ishga tushirish uchun foydalanadigan o‘zgartirilgan runit skriptlari orqali boshlanadi. Bir versiyada SSH xizmati skripti haqiqiy SSH serveridan oldin confsshd deb nomlangan yuklovchi skriptni ishga tushiradi. confsshd skripti vdaemon jarayon identifikatorlarini faylga yozadi, rsshd deb nomlangan vosita esa KeyDrift’ning asosiy moduli PolyFlame’ni har bir jarayonga kiritadi.
PolyFlame vdaemon ichida xotirada ishlaydi. U TinyShell’ga o‘xshash orqa eshik sifatida buyruqlarni bajarishi va fayllarni o‘qishi/yozishi, yoki buyruqlarni o‘z buyruq serveri va boshqa mashinalar o‘rtasida o‘tkazadigan relay sifatida ishlashi mumkin. U SD-WAN boshqaruv trafikida buyruqlarni qabul qilishga mo‘ljallangan va tahlil qilingan namunalarda qattiq kodlangan server manzili yo‘q.
Buzilgan Validator’da (avval vBond) /etc/sv/aaamgr/ ostida soxta aaamgr xizmati aaamgrd deb nomlangan qadoqlangan yuklovchini ishga tushiradi, u PolyFlame’ni shifrlab ishga tushiradi. Cisco’ning haqiqiy aaamgr komponenti Python paketi bo‘lib, odatda kompilyatsiya qilingan xizmat sifatida ishlamaydi.
Shuningdek, vaqt belgilarini o‘zgartirish (timestomping) alomatlari ham bor: guruh bajargan buyruqlar o‘z fayllariga mavjud fayllarning vaqt belgilari va ruxsatlarini nusxalagan.
Ta’sirlangan relizlar va tuzatishlar
CVE-2026-20127 Catalyst SD-WAN Controller (avval vSmart), Manager (avval vManage) va Validator (avval vBond) ga ta’sir qiladi, ularning konfiguratsiyasidan qat’i nazar. Mahalliy tizimlar, shuningdek Cisco’ning SD-WAN bulutli joylashuvlari, jumladan Cisco Managed va FedRAMP muhitlari ham ta’sirlangan. Cisco 16-iyunda Validator’ni o‘z maslahatiga qo‘shdi.
Cisco zaiflikning cheklangan ekspluatatsiyasidan xabardor ekanini aytadi. Hech qanday vaqtinchalik yechim yo‘q va birinchi tuzatilgan relizlar quyidagilar:
| Reliz treyni | Birinchi tuzatilgan reliz |
|---|---|
| 20.9 dan oldin | Tuzatilgan relizga ko‘chish |
| 20.9 | 20.9.8.2 |
| 20.11 | 20.12.6.1 |
| 20.12 | 20.12.5.3 yoki 20.12.6.1 |
| 20.13 | 20.15.4.2 |
| 20.14 | 20.15.4.2 |
| 20.15 | 20.15.4.2 |
| 20.16 | 20.18.2.1 |
| 20.18 | 20.18.2.1 |
20.9 dan oldingi va 20.11, 20.13, 20.14 va 20.16 treynlari dasturiy ta’minot xizmat muddati tugagan.
Yangilash mumkin bo‘lguncha, mahalliy mijozlar 22 va 830 portlariga kirishni faqat ma’lum controllerlar va boshqa ma’lum tizimlarning IP manzillariga cheklashi mumkin. Cisco bu qadam sinov muhitida ishlaganini, lekin mijozlar o‘z tarmoqlarida qanchalik yaxshi ishlashini tekshirishlari kerakligini aytadi. Bunday himoya choralari Cisco’ning SD-WAN bulutli joylashuvlari uchun allaqachon mavjud.
Portlarni bloklash qurilmada allaqachon mavjud zararli dasturiy ta’minotni o‘chirmaydi.
KeyDrift’ni tekshirish
Talos tashkilotlarga Cisco tuzatishlarini o‘rnatish, Cisco Catalyst SD-WAN qattiqlashtirish qo‘llanmasiga amal qilish va buzilishdan keyingi faoliyat alomatlarini kuzatishni maslahat beradi. Bunday alomatlarni topgan har kim hodisaga javob berishni boshlashi va Cisco’ning Texnik Yordam Markazidan (TAC) yordam so‘rashi mumkin.
Bu maslahat yangilash allaqachon buzilgan qurilmadan KeyDrift’ni o‘chiradimi yoki biror kalitni almashtirish kerakmi, degan savolga javob bermaydi. Bu zaiflik uchun Cisco’ning fevral oyidagi tuzatish qo‘llanmasi yangilashdan oldin “mavjud ekspluatatsiyalar hali ham joyida bo‘lishi mumkin” deb ogohlantiradi.
KeyDrift quyidagi fayl va joylashuvlardan foydalanadi, ba’zilari faqat nomi bilan berilgan:
- Fayl:
etc/sv/sshd/ostidagirunskripti, conf_sshd’ni ishga tushirish uchun o‘zgartirilgan - Katalog:
/etc/sv/aaamgr/, buzilgan Validator’dagi soxta xizmat - Fayl:
aaamgrd, qadoqlangan yuklovchi - Fayl:
conf_sshd, yuklovchi skript - Fayl:
rsshd, kirituvchi - Fayl:
libdssl.so, PolyFlame - Fayl:
libcommon.so, LittleFilch - Fayl:
/tmp/system-vdaemon, vdaemon jarayon identifikatorlari ro‘yxati - Fayl:
/var/tmp/vdaemon.bin, LittleFilch’ning shifrlangan yozuvlari - Fayl:
/var/tmp/vdaemon.conf, LittleFilch’ning yuborish sozlamalari, o‘qib bo‘lgach o‘chiriladi
Talos hisobotida KeyDrift uchun fayl xeshlar, IP manzillar yoki domenlar ro‘yxati yo‘q.
Talos 28-oktabrda kiruvchi KeyDrift buyruq-va-boshqaruv ulanishlarini aniqlaydigan Snort qoidalarini e’lon qildi: Snort 2 uchun 67387 dan 67416 gacha, Snort 3 uchun 7:44 dan 7:73 gacha. Allaqachon mavjud 65938 va 65958 qoidalar CVE-2026-20127’ning o‘zini qamrab oladi.
28-oktabrdagi qoidalar yangilanishi Snort 2 qoidalarini sukut bo‘yicha o‘chirilgan deb ro‘yxatga oladi, shuning uchun pullik Snort Subscriber qoidalar to‘plami foydalanuvchilari ularni yoqishi kerak. Snort 3 qoidalari esa sukut holati ko‘rsatilmagan holda paydo bo‘ladi.
Zaiflikning o‘zini ekspluatatsiya qilishni tekshirish uchun Cisco /var/log/auth.log da noma’lum IP manzillardan Accepted publickey for vmanage-admin yozuvlarini qidirishni aytadi. TAC ishini ochishdan oldin mijozlar har bir boshqaruv komponentida request admin-tech buyrug‘ini bajarishlari kerak. Tuzatish qo‘llanmasi shuningdek, bu admin-tech fayllarini Bug Search Tool sahifasidagi CSCws52722 xato uchun Check Bug Applicability funksiyasi bilan qayta skanerlashni tavsiya qiladi.
AQSh federal fuqarolik agentliklari uchun CISA’ning 25-fevraldagi favqulodda direktivasi root hisob buzilishi topilsa nima qilish kerakligini belgilaydi. Ular buni CISA’ga xabar qilishlari, tuzatilgan tasvirlardan yangi Manager, Controller va Validator nusxalarini joylashtirishlari va chekka routerlarini yangi tizimlarga ko‘chirishlari kerak.
Hackers exploited a critical Cisco Catalyst SD-WAN flaw, fixed in February, to plant custom malware inside the systems that control an organization's SD-WAN network.
The malware, called KeyDrift, is designed to copy the keys that encrypt traffic between sites and store them for later use, Cisco Talos said on October 28. Talos calls the attacks historical but does not specify when they occurred or whether any keys were sent.
The flaw is tracked as CVE-2026-20127 and has a CVSS score of 10.0. It allows an unauthenticated remote attacker to bypass authentication and gain administrative privileges on these control systems. On a Controller, the attacker can log in as a high-privileged internal account that is not root.
When Cisco disclosed the flaw in February, Talos tracked its exploitation as UAT-8616, a cluster of activity it said went back to at least 2023.
In Cisco's traditional key exchange, each SD-WAN router periodically generates an AES key for its traffic and sends it to the Catalyst SD-WAN Controller (formerly vSmart). The Controller passes the keys on to other routers. A process on the Controller called vdaemon runs the encrypted control connections that carry these keys.
On a compromised Controller, a KeyDrift component called LittleFilch hooks into vdaemon and reads control messages after they are decrypted. For a preset list of edge routers, it pulls out their IP addresses and a 32-byte field. Talos assesses that field as the AES-256 key material that the Controller passes between routers.
LittleFilch encrypts what it collects with RSA and writes it to a file. It can then send that data over UDP to an address listed in a settings file, which it deletes after reading. Talos could not recover that settings file.
The group behind KeyDrift, which Talos tracks as UAT-11473, has targeted space and satellite services, defense and aerospace technology, and policy research.
The group's infrastructure "overlaps considerably" with Silent Train, Talos assesses with high confidence. Silent Train is the name Lumen's Black Lotus Labs uses for a network of hacked small-office, home-office, IoT and business devices.
Lumen says Volt Typhoon used the network to hide its activity. CISA, the NSA and the FBI said in 2024 that Volt Typhoon is a Chinese state-sponsored cyber group.
Talos links UAT-11473 to Volt Typhoon only through the infrastructure overlap. It does not say the two are the same group, or how UAT-11473 relates to UAT-8616, the cluster it reported in February.
Separately, Lumen said on October 28 that Volt Typhoon was exploiting CVE-2026-20127 by late 2025 and continued to exploit it after Cisco disclosed the flaw in February. Lumen does not tie that activity to KeyDrift.
KeyDrift primarily starts via modified runit scripts that Cisco SD-WAN devices use to launch their services, according to Talos. In one version, the script for the SSH service starts a loader script, confsshd, before the real SSH server. The confsshd script writes vdaemon's process IDs to a file, and a tool called rsshd injects KeyDrift's main module, PolyFlame, into each of those processes.
PolyFlame runs in memory inside vdaemon. It can act as a TinyShell-like backdoor that runs commands and reads and writes files, or as a relay that forwards commands between its command server and other machines. It is built to accept commands within SD-WAN control traffic, and the analyzed samples contained no hardcoded server address.
On a compromised Validator, formerly vBond, a fake aaamgr service under /etc/sv/aaamgr/ runs a packed loader, aaamgrd, that decrypts and runs PolyFlame. Cisco's real aaamgr component is a Python package and does not normally run as a compiled service.
There are also signs of timestomping: commands the group ran copied the timestamps and permissions of existing files onto its own files.
Affected Releases and Fixes
CVE-2026-20127 affects the Catalyst SD-WAN Controller (formerly vSmart), Manager (formerly vManage), and Validator (formerly vBond), regardless of their configuration. On-premises systems are affected, as are Cisco's hosted SD-WAN cloud deployments, including the Cisco Managed and FedRAMP environments. Cisco added the Validator to its advisory on June 16.
Cisco says it is aware of limited exploitation of the flaw. There is no workaround, and the first fixed releases are:
| Release train | First fixed release |
|---|---|
| Earlier than 20.9 | Migrate to a fixed release |
| 20.9 | 20.9.8.2 |
| 20.11 | 20.12.6.1 |
| 20.12 | 20.12.5.3 or 20.12.6.1 |
| 20.13 | 20.15.4.2 |
| 20.14 | 20.15.4.2 |
| 20.15 | 20.15.4.2 |
| 20.16 | 20.18.2.1 |
| 20.18 | 20.18.2.1 |
Releases earlier than 20.9 and the 20.11, 20.13, 20.14 and 20.16 trains have reached end of software maintenance.
Until they can upgrade, on-premises customers can limit access to ports 22 and 830 to the IP addresses of known controllers and other known systems. Cisco says this step worked in a test environment, but that customers should check how well it works in their own networks. Such guardrails are already in place for Cisco's hosted SD-WAN cloud deployments.
Blocking the ports does not remove malware already on a device.
Checking for KeyDrift
Talos advises organizations to install Cisco's fixes, follow Cisco's Catalyst SD-WAN hardening guide and watch for signs of post-compromise activity. Anyone who finds such signs should start incident response and can ask Cisco's Technical Assistance Center (TAC) for help.
That advice does not say whether upgrading removes KeyDrift from a device that was already compromised, or whether any keys should be replaced. Cisco's February remediation guide for this flaw warns that there could be "existing exploits which are still in place" from before an upgrade.
KeyDrift uses these files and locations, some given only by name:
- File: the
runscript underetc/sv/sshd/, modified to start conf_sshd - Directory:
/etc/sv/aaamgr/, a fake service on a compromised Validator - File:
aaamgrd, the packed loader - File:
conf_sshd, the loader script - File:
rsshd, the injector - File:
libdssl.so, PolyFlame - File:
libcommon.so, LittleFilch - File:
/tmp/system-vdaemon, the list of vdaemon process IDs - File:
/var/tmp/vdaemon.bin, LittleFilch's encrypted records - File:
/var/tmp/vdaemon.conf, LittleFilch's send settings, deleted after reading
Talos's report does not include a list of file hashes, IP addresses or domains for KeyDrift.
Talos released Snort rules on October 28 that look for inbound KeyDrift command-and-control connections: 67387 through 67416 for Snort 2, and 7:44 through 7:73 for Snort 3. Rules 65938 and 65958, already available, cover CVE-2026-20127 itself.
The October 28 rule update lists the Snort 2 rules as disabled by default, so users of the paid Snort Subscriber rule set must turn them on. The Snort 3 rules appear with no default state.
To check for exploitation of the flaw itself, Cisco says to look in /var/log/auth.log for Accepted publickey for vmanage-admin entries from unknown IP addresses. Before opening a TAC case, customers should run request admin-tech on each control component. The remediation guide also recommends rescanning those admin-tech files with the Check Bug Applicability feature on the Bug Search Tool page for bug CSCws52722.
For US federal civilian agencies, CISA's February 25 emergency directive sets out what to do if a root account compromise is found. They must report it to CISA, deploy fresh Manager, Controller and Validator instances from patched images, and move their edge routers to the new systems.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
