Cisco Talos says a threat cluster it tracks as UAT-11473 exploited CVE-2026-20127, a maximum-severity flaw in Cisco Catalyst SD-WAN, to install custom malware called KeyDrift on the systems that control an organization’s branch network links. The malware is designed to copy the AES-256 keys that protect traffic between SD-WAN sites, which would give an intruder a durable way to read or tamper with that traffic.
How UAT-11473 Turned CVE-2026-20127 Into Control of SD-WAN Appliances
CVE-2026-20127 carries a CVSS score of 10.0. It is an unauthenticated authentication bypass that hands an attacker administrator privileges, and Cisco fixed it in February. Talos reported on October 28 that UAT-11473 used the flaw to reach Catalyst SD-WAN Controllers, known as vSmart, and vBond appliances, then deployed KeyDrift on them.
Talos describes the intrusions as “historical.” It does not say when they took place, how many organizations were affected, or whether any stolen keys actually left the victim networks. That leaves a gap between what the malware is built to do and what the investigation has confirmed it did.
PolyFlame and LittleFilch: The Two KeyDrift Components
KeyDrift has two main parts. PolyFlame, delivered as the file libdssl.so, is a memory-resident module injected into the vdaemon process. Talos says it works as a TinyShell-style backdoor or as a command relay. Operators validate commands by comparing an MD5 hash against the local date, a check that limits who can issue instructions to an implanted device.
LittleFilch, delivered as libcommon.so, does the key theft. It hooks SSL_read inside vSmart processes and pulls out 32-byte key fields along with router IP addresses. The module encrypts the harvested material with RSA, writes it to /var/tmp/vdaemon.bin and then sends it out over UDP.
Runit Script Changes and a Packed ELF Variant on vBond
For persistence, the attackers modified runit service scripts for sshd and aaamgr. A loader named conf_sshd and a ptrace-based injector named rsshd then place PolyFlame into each vdaemon process. On vBond appliances, Talos found a packed ELF variant that masquerades as the aaamgrd daemon. The operators also timestomped files, altering timestamps to make forensic timelines harder to reconstruct.
What Talos Says About UAT-11473 and Its Links to Volt Typhoon
Talos says UAT-11473 has targeted space and satellite services, defense and aerospace technology, and policy research. The cluster’s infrastructure “overlaps considerably” with the Silent Train network associated with Volt Typhoon, a link Talos rates at high confidence. Lumen, in a separate report published the same day, said Volt Typhoon was exploiting CVE-2026-20127 by late 2025 and kept doing so after Cisco’s February disclosure. Lumen does not connect that activity to KeyDrift. The Silent Train relay network is covered in detail in the companion reporting on Lumen’s findings.
Open Questions Around UAT-8616 and Shared Infrastructure
Talos does not say that UAT-11473 and Volt Typhoon are the same group. It also does not explain how UAT-11473 relates to UAT-8616, the cluster it tied to this same flaw in February, with activity going back to at least 2023. Infrastructure overlap can reflect shared tooling, shared operators or a shared access broker, and the public reporting does not settle which applies here.
Why Stolen SD-WAN Keys Raise the Stakes for Cisco Customers
The disclosure points to a risk specific to control-plane compromise. An SD-WAN controller coordinates the encrypted tunnels between sites, so access to it can expose the keys behind many tunnels at once instead of the traffic of a single host. An implant that lives in the vdaemon process memory, as PolyFlame does, also leaves little on disk for a routine scan to find.
The timeline adds a second problem. The fix has been available since February, yet Lumen places Volt Typhoon’s exploitation of the flaw in late 2025, months before the patch existed. A patch closes the door but does not remove an implant already resident in memory or in modified service scripts, so a patched controller is not necessarily a clean one.
Cisco customers running Catalyst SD-WAN are directed to the fixed releases issued in February. Talos has published indicators of compromise and detection guidance, which give responders a starting point for checking vSmart and vBond systems for the file names, paths and modified scripts described above.
