Hackers Target Satellite Firms With KeyDrift as the Air Force Plans a $30 Million Push Beyond GEO

A newly identified hacking group has been breaking into space and satellite service companies, defense firms and policy research groups with a custom tool built to steal encryption keys, Cisco’s threat intelligence team said this week. The group, which Cisco Talos tracks as UAT-11473, exploited a patched flaw in Cisco Catalyst SD-WAN controllers to install the tool, called KeyDrift, BleepingComputer reported.

Key figures: $945.9M planned boeing satellite deal (up to) · $42.5M hughes multi-orbit software task order · $30M AFRL Cislunar Prime awards, 15 x $2M

Why it matters: satellites now carry military communications, navigation and intelligence traffic, so stolen keys could expose links that commanders depend on. The campaign surfaced as the US Air Force and Space Force moved money toward new orbits and new ways to keep data flowing if a link is jammed.

What Talos found

Talos assessed “with high confidence” that KeyDrift is designed to provide “long-term persistent access and automated exfiltration of sensitive keying material.” The flaw, CVE-2026-20127, is a maximum-severity bug that Cisco patched in February 2026. Talos said the group appears to overlap with Volt Typhoon’s “Silent Train” covert access network, but made no definitive link. Today’s information war story covers the same campaign alongside the record Binance theft.

China’s space plane overhead

China’s reusable Shenlong spacecraft is on its fourth mission, and skywatchers in the United States may be able to see it pass over between October 30 and early November, Space.com reported, citing the tracking site Heavens-Above. China’s space agency has said only that it is testing technology for “more convenient and affordable round-trip methods for the peaceful use of space.”

Money moves to new orbits

The Air Force Research Laboratory plans to announce a challenge called Cislunar Prime in December, seek proposals in January and start awarding contracts next spring, Air & Space Forces Magazine reported. The program has $30 million for 15 Small Business Innovation Research contracts of $2 million each, covering space domain awareness, communications, and positioning, navigation and timing. The lab’s Oracle program plans to launch its first cislunar satellite in December. “I would characterize cislunar as even harder and more difficult, and we really don’t see what’s going on in that arena,” said Maj. Gen. Stephen Purdy, the Space Force’s portfolio acquisition executive for advanced programs.

Closer to Earth, Hughes said Space Systems Command awarded it a $42.5 million task order on October 29 to build software that lets military terminals switch traffic among geostationary, medium and low Earth orbit networks, SatNews reported. Hughes said the system is meant to reroute data if a link is jammed or disrupted.

The biggest number of the week belongs to Boeing. The Space Force plans to award the company a sole-source contract worth up to $945.9 million to maintain and modernize military communications satellites and ground systems, SpaceNews reported on October 28. The service cited Boeing’s ownership of proprietary technical data and software needed for the work.

The Space Force courts industry

Space Systems Command said on October 30 that more than a dozen Space Force program offices met with companies at its Space Enterprise Consortium meeting in Los Angeles on October 20, according to the command. “We are looking beyond any single satellite, launch, company or contract and building an enterprise that will adapt as threats change,” said Col. Andrew Menschner, the command’s deputy commander. Our report on the Pentagon commissary cyberattack probe covers another recent Pentagon cyber case.

By the numbers

The planned Boeing deal is about 22 times the Hughes task order and about 32 times the entire Cislunar Prime pool, TBR calculations from the reported figures. Together, the three amounts total about $1.02 billion. No new reports on satellite use in the Russia-Ukraine or Middle East wars were found for the period.

What comes next

Watch for Cisco or federal guidance on the KeyDrift campaign and any named victims, the formal Boeing award, the Cislunar Prime announcement in December and the first Oracle cislunar launch. Today’s Ukraine war story covers the fighting on the ground.

Sources

• BleepingComputer: Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware
• Space.com: China's secretive space plane is flying over the US this week — here's how to see it for yourself
• Air & Space Forces Magazine: AFRL Plans to Award $30M for Cislunar Project Starting Next Spring
• SatNews: Hughes Secures $42.5M Space Systems Command Award for Multi-Orbit Automated EM&C Architecture
• SpaceNews: Boeing to be awarded sole-source deal worth up to $946 million to maintain military satellites
• US Space Force, Space Systems Command: Space Enterprise Consortium Unites Industry Leaders and Space Force Acquisition Program Offices to Fast-Track National Security Capabilities