UAT-11473 used Cisco SD-WAN auth bypass to plant KeyDrift
Original title: Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
Talos says the implant lives in controller processes, steals data-plane keys, and overlaps Volt Typhoon infrastructure.
Cisco Talos identified UAT-11473 as an APT that exploited CVE-2026-20127, an authentication-bypass flaw in Cisco SD-WAN Catalyst Controller, then installed a custom framework it calls KeyDrift. The framework's PolyFlame and LittleFilch components act as backdoors and intermediate command-and-control hosts and collect keying material from decrypted control-plane traffic inside legitimate controller processes. Talos says the goal is long-term access and automated exfiltration, with observed targets in space and satellite services, defense and aerospace, and policy research. Talos assesses with high confidence that the actor's infrastructure overlaps Volt Typhoon's Silent Train covert access network.
Unconfirmed: The Volt Typhoon infrastructure overlap is Talos's high-confidence assessment, not an independently confirmed attribution.
- PolyFlame is injected into vdaemon and can also masquerade as a packed aaamgrd loader.
- LittleFilch hooks SSL_read, extracts keys for predefined edge nodes, and stages encrypted data.
- Talos found no hardcoded IPs, ports, domains, or polling intervals in analyzed PolyFlame samples.
- Module and deployment variations indicate the framework is still being developed.
Impact: Authentication bypass and theft of SD-WAN control-plane keying material
| Product | Affected |
|---|---|
| Cisco SD-WAN Catalyst Controller | — |
- CVEs
- CVE-2026-20127
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1055 Process InjectionT1552.004 Private KeysT1041 Exfiltration Over C2 Channel
- Vendors
- Cisco
- Products
- Cisco SD-WAN Catalyst Controller
- Threat actors
- UAT-11473Volt Typhoon
- Malware
- KeyDriftPolyFlameLittleFilch
- Organizations
- Cisco Talos
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-20127 | Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator | 10.0 | 89% | KEV | KEV |
From the original article
8 min read at blog.talosintelligence.com
Talos has identified UAT-11473, a highly sophisticated APT, who exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances to bypass authentication and gain unauthorized access to affected systems to deploy KeyDrift.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.