View Ridge Security
Back to Cyber Hose

Cisco SD-WAN zero-day exploited to plant KeyDrift malware

A CVSS 10.0 Cisco SD-WAN zero-day heads this run, alongside a second exploited ASA/FTD VPN flaw and 319 Chrome extensions hijacking 13.4M users' searches.

🚨 ACTIVE EXPLOITATION

  • Cisco SD-WAN zero-day exploited to plant KeyDrift malware linked to Volt Typhoon's Silent Train network
    Cisco Talos reports that a sophisticated APT exploited a critical Cisco SD-WAN flaw to plant KeyDrift malware that steals encryption keys, with infrastructure overlapping Volt Typhoon's Silent Train network.

    • Applies to Cisco Catalyst SD-WAN Controller (vSmart), Manager (vManage), and Validator (vBond), including on-premises and Cisco-hosted cloud deployments
    • CVE-2026-20127 (CVSS 10.0) is an unauthenticated authentication bypass granting admin access; exploited by UAT-11473 to deploy the KeyDrift malware framework
    • KeyDrift's PolyFlame module is injected into vdaemon processes via modified runit scripts, acting as a TinyShell-like backdoor and intermediate C2; LittleFilch hooks SSL_read to extract AES-256 key material and exfiltrate it RSA-encrypted over UDP
    • Talos assesses with high confidence that UAT-11473's infrastructure overlaps considerably with Volt Typhoon's 'Silent Train' covert access network, which Lumen says was used in zero-day campaigns against Versa Director, N-able N-central, Cisco SD-WAN, and VeloCloud Orchestrator
    • Victims include space/satellite services, defense and aerospace, telecoms, government, and critical infrastructure; fixed releases range from 20.9.8.2 to 20.18.2.1 depending on train
    Sources 📎 Coverage: securityweek.com · 👁 via SecurityWeek, The Hacker News

  • Cisco patches second exploited ASA/FTD VPN zero-day used for DoS attacks
    Cisco has patched a second actively exploited zero-day in its ASA and FTD firewalls' Remote Access SSL VPN service that lets unauthenticated attackers remotely crash the devices.

    • Affects Cisco Secure Firewall ASA and FTD software running the Remote Access SSL VPN service; cloud-delivered firewall, Secure Access, and Secure Firewall Management Center are not vulnerable.
    • Tracked as CVE-2026-76418 (CVSS 8.6), the flaw lets unauthenticated attackers remotely force devices to reload, disrupting availability.
    • Exploitation requires an unpatched release, a reachable SSL VPN login service, and a tunnel group configured with secondary authentication; a malicious request during VPN connection triggers the flaw without a successful login.
    • Cisco learned in October the flaw was being exploited in the wild; it surfaced via a TAC support case and no details on attackers have been shared.
    • It is the second exploited ASA/FTD VPN zero-day since August, when Cisco fixed CVE-2026-20349, a similar unauthenticated remote reload flaw.
    Sources 📎 Coverage: securityweek.com · 👁 via SecurityWeek

🕵️ RESEARCH & DEEP DIVES

  • Unknown APT uses NetamLoader framework to attack custom government Windows 10 build in Asia
    Kaspersky has uncovered a sophisticated targeted attack using the NetamLoader .NET loading framework against a customized Windows 10 OS used by Asian governments.

    • Targets a custom Windows 10 build used exclusively by government entities in Asia; no attribution to a known APT group has been made.
    • The infection chain was flagged via a .config file using AppDomainManager injection to load arbitrary .NET assemblies, packaged in a CAB archive placed in C:\Windows\SoftwareDistribution\Download.
    • The CAB contained mostly legitimate Patch My PC patch-management components and Microsoft-signed assemblies, suggesting a supply-chain attack; PatchMyPC-ScriptRunner.exe served as the host process.
    • NetamLoader is a complex two-stage XAML-based .NET assembly-loading framework with AES-encrypted network traffic and proxy discovery; detected as HEUR:Trojan.MSIL.NetamLoader.gen.
    • The sample surfaced in the first half of 2026 via a Kaspersky Security Network detection alert.
    Sources 📎 Coverage: securelist.com · 👁 via Securelist (Kaspersky)

  • 319 Chrome extensions hijacked searches of 13.4 million users via search provider override
    Researchers identified 319 Chrome extensions that hijacked user searches for referral ad revenue, affecting roughly 13.4 million installs over a decade.

    • Chrome users are affected: 319 extensions marketed as PDF converters, manual finders, safe search tools, and AI search helpers, with ~13.4 million installs dating back to 2016
    • The extensions abuse Chrome's chrome_settings_overrides.search_provider setting to replace the default search engine, routing queries through operator-controlled servers before sending users to Yahoo or Bing
    • Operators monetize queries via search syndication referral programs; Predator Search showed server-side control, with six identical queries producing four different outcomes including redirects and error pages
    • Most extensions were unlisted in the Chrome Web Store and distributed through paid popunders and popunder ads; clusters include Intango LTD (~111 extensions, 2.2M installs), SecuryBrowse (58 extensions, ~4.9M users), and a 37-extension Bing-focused group
    • IOCs include extension ID odkcfoohjiicbelloepgcomekdknchjh (Predator Search), domains search.safesearchgame[.]com, suggest.safesearchgame[.]com, searchlio[.]net, searchtosearch[.]com, mcftink[.]com, extension-search[.]online, and tracking parameters hspart=sz&hsimp=yhs-026 plus Bing codes PC=3FPX, PC=3VSS, PC=3QCV, PC=3CGP
    Sources 📄 Source: socket.dev · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)

  • CyberDakait banking trojans infect 17,960 Android phones in India, steal 7.6M SMS
    Group-IB's CyberDakait campaign infected 17,960 Android devices in India with seven banking trojan families and intercepted over 7.6 million SMS messages.

    • Targets Indian bank customers, impersonating 11 Indian banks and two government programs via fake 'Credit Card Protection Plan' calls and phishing sites.
    • Stolen data includes OTPs, transaction alerts, card numbers, CVV codes, PAN and Aadhaar details; 7,611,443 SMS intercepted in total.
    • Malicious APKs hosted in GitHub repos, delivered via phishing links often on WhatsApp; fake Google Play update screen and battery-optimization prompts keep the malware running.
    • Seven trojan families identified (cyb3rx, appkjl, godz, d-passive, d-shine, GhostBat, tenxen) exfiltrate SMS to Telegram bots and Firebase; d-miner uses XMRig for unauthorized crypto mining.
    • Group-IB traced the activity to July 2025 with victim reports from January 2025; phishing domains include 81service[.]icu and cardprotections[.]online.
    Sources 📄 Source: group-ib.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)

  • Chain of Axis Camera Station flaws yields unauth RCE and decryption of all camera credentials CVE-2025-30023 CVE-2025-30026 CVE-2026-63286
    A researcher chained three Axis Camera Station vulnerabilities to achieve unauthenticated SYSTEM-level RCE and decrypt all stored camera credentials, releasing public exploits.

    • Affects AXIS Camera Station Pro before 6.9 and AXIS Camera Station before 5.58 (plus AXIS Device Manager before 5.32); CVE-2026-63286 fixed in Camera Station Pro 6.20
    • CVE-2025-30026 (authentication bypass, CVSS 4.8) and CVE-2025-30023 (insecure deserialization, CVSS 9.0) chain to unauthenticated remote code execution as SYSTEM
    • Exploit works over the app's binary HTTP protocol on port 55752, using a self-signed client certificate and a Ysoserial.net WindowsIdentity gadget in a LogOnAsync request
    • CVE-2026-63286 (CVSS 7.1): camera credentials in Firebird databases are AES-256-CBC encrypted with a key derived from hard-coded constants and the host's NTFS Volume Serial Number, allowing decryption or a 32-bit GPU brute-force of DB backups
    • PoC exploits published at github.com/ricardojoserf/axis-RCE and github.com/ricardojoserf/CVE-2026-63286
    Sources 📄 Source: axis.com · 📎 Coverage: ricardojoserf.github.io · 👁 via r/netsec

  • Shadowy AI relay service disables OpenAI Codex, Claude Code sandboxes for users in China, other regions
    Symantec researchers found an unauthorized relay service installing OpenAI Codex and Claude Code tools with key security features disabled for enterprise users in restricted regions.

    • A relay service active since early 2026 has installed genuine but unauthorized OpenAI Codex and Claude Code CLIs on systems at about a dozen organizations, primarily in mainland China plus South Korea, Taiwan, and Malaysia.
    • Installations route requests through the relay's infrastructure instead of OpenAI's or Anthropic's networks, replacing user API credentials with relay-issued tokens that persist across reboots.
    • Users fetch a fileless PowerShell or bash installer from a lookalike domain via a one-line command when installing the CLIs through npm; the CLI clients themselves are not modified or Trojanized.
    • The relay disables the CLIs' execution sandbox, enables network access for the write sandbox, and turns off telemetry and error reporting; in one case it logged a user out of their Anthropic session and deleted their authentication variables.
    • No malware or malicious activity has been observed, but Symantec warns the relay can see every prompt, file, and secret sent to the agent and could execute malicious responses with the user's full privileges.
    Sources 📎 Coverage: darkreading.com · 👁 via Dark Reading

  • Cisco Talos details NIK C2, a new AI-enabled command-and-control framework observed in the wild
    Cisco Talos has identified NIK C2, a new AI-integrated command-and-control framework actively used in the wild.

    • NIK C2 targets Windows machines with a Go-based 64-bit implant offering credential dumping, keystroke streaming, RDP session hijacking, process hollowing, and lateral movement.
    • The implant integrates the OpenAI Chat Completions API, letting operators send prompts from the victim host and have AI analyze harvested data in-session; it can fall back to the victim's own OPENAI_API_KEY, billing the victim for the attacker's AI usage.
    • It can deploy desktop screen-locking ransomware demanding Bitcoin or USDT payments.
    • Communication uses TLS-secured WebSockets on port 443 with an HTTP fallback polling every 250 ms, AES-256-GCM encryption, and three prioritized C2 tiers for resilience.
    • Observed infrastructure includes server 87.120.196[.]120 resolving to total-sitevv[.]lol, with a TLS certificate CN of nik-panel; Talos published IOCs on GitHub.
    Sources 📎 Coverage: blog.talosintelligence.com · 👁 via <https://blog.talosintelligence.com

Need help assessing your exposure?

Start with the free Posture Self-Check to see where you stand against the current threat landscape.

Free Posture Self-Check