Overview
Cisco Talos has identified a new advanced persistent threat cluster, UAT-11473, exploiting CVE-2026-20127 — a maximum-severity authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers — to deploy a custom malware framework named KeyDrift.
CVE-2026-20127 lets a remote attacker gain privileged access to the Controller and Manager and add rogue peers. Cisco patched it in February 2026. A separate cluster, UAT-8616, has used the same flaw as a zero-day since at least 2023, and recent research linked that activity to Volt Typhoon.
KeyDrift Malware
Talos assesses with high confidence that KeyDrift provides persistent access to SD-WAN controllers and automated exfiltration of keying material. It runs inside SD-WAN control-plane processes and can intercept decrypted control traffic, extract control-session metadata, and pull data-plane keys.
| Component | Role |
|---|---|
| PolyFlame | Runs inside legitimate vdaemon processes through modified service startup scripts and an injector. Supports command execution, file upload and download, and relaying traffic between the C2 server and peers. |
| LittleFilch | Hooks SSL_read to inspect decrypted control-plane messages. For predefined edge nodes it extracts IP identifiers and a 32-byte field Talos assesses to be AES-256 IPsec data-plane key material, encrypts it with RSA, writes it to /var/tmp/vdaemon.bin, and sends it to the attackers over UDP. |
Talos observed ongoing development, including new anti-debugging mechanisms and varied process impersonation.
Targeting and Attribution
Observed targets include:
- Space and satellite services
- Defense and aerospace technology
- Policy research organizations
Talos says the UAT-11473 cluster "appears to overlap" with Volt Typhoon's Silent Train network, which Lumen described in a separate report, but it has not made a definitive link.
Detection and Mitigation
- Apply Cisco's security updates for CVE-2026-20127 on all Catalyst SD-WAN Controllers and Managers.
- Follow Cisco's hardening guide for Catalyst SD-WAN deployments.
- Look for the file
/var/tmp/vdaemon.binand for unusualvdaemonprocess behavior or impersonation. - Audit SD-WAN peers for rogue or unrecognized devices.
- If compromise is suspected, treat IPsec data-plane keys as exposed and rotate them.
Talos did not publish hashes, IP addresses, or domains in the coverage reviewed.