Threat reportAPTTL-2026-4677
KeyDrift: UAT-11473 Activity on Cisco SD-WAN (CVE-2026-20127)
KeyDrift: UAT-11473 Activity on Cisco SD-WAN (TL-2026-4677), also tracked as KeyDrift, is a critical-severity advanced persistent threat campaign scored CVSS 10, first published 2026-10-28. It is attributed to UAT-11473 with medium confidence, affects Cisco Catalyst SD-WAN Controller (formerly vSmart), references 1 CVE (CVE-2026-20127), maps to 16 MITRE ATT&CK techniques (T1005, T1027.002, T1036.004), and is covered by 9 detection rules and 13 indicators of compromise.
- CVSS
- 10/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 16MITRE ATT&CK
- Actors
- 1UAT-11473
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 13Indicators of compromise
Key facts for TL-2026-4677
- Threat ID
- TL-2026-4677
- Also known as
- KeyDrift, PolyFlame, LittleFilch
- Severity
- CRITICAL
- CVSS
- 10
- Status
- ACTIVE
- Category
- APT
- First published
- Last reviewed
- Attribution
- UAT-11473
- Attribution confidence
- MEDIUM
- Motivation
- ESPIONAGE
- Target sectors
- space and satellite services, defense and aerospace, policy research, telecoms
- Detection rules
- 9
- Indicators of compromise
- 13
Malware and tooling in KeyDrift: UAT-11473 Activity on Cisco SD-WAN
Malware and tooling: KeyDrift, LittleFilch, PolyFlame
How KeyDrift: UAT-11473 Activity on Cisco SD-WAN works
Cisco Talos analyzes historical activity by UAT-11473, an APT actor, against Cisco Catalyst SD-WAN controllers using the custom KeyDrift malware framework (PolyFlame and LittleFilch components). Talos assesses with high confidence that UAT-11473's operating infrastructure overlaps considerably with Volt Typhoon's 'Silent Train' covert access network; targeting includes space and satellite services, defense and aerospace technology, and policy research.
Cisco Talos (published 2026-10-28) describes KeyDrift, a custom malware framework built for Cisco SD-WAN controller environments and attributed to the APT cluster UAT-11473. KeyDrift provides persistent residence on the controller, in-band traffic access, and extraction of key material from decrypted control-plane messages. Talos reports the activity as historical and tied to CVE-2026-20127, an authentication bypass in the peering authentication mechanism of Cisco Catalyst SD-WAN Controller (formerly vSmart) and Manager (formerly vManage). Cisco disclosed CVE-2026-20127 on 2026-02-25 as exploited in the wild (CVSS 10.0); CISA added it to the KEV catalog and issued Emergency Directive ED-26-03 on 2026-02-26. Other vendor reporting attributes the CVE's exploitation since 2023 to a separate Talos-tracked cluster, UAT-8616; the Talos KeyDrift report is the source for UAT-11473 and the two designations should not be conflated without further evidence.
The framework has two main implants. PolyFlame (libdssl.so) is a memory-resident module injected into vdaemon processes; it interposes socket, DTLS and runtime-linker functions and supports arbitrary command execution (command code 0x100), file write (0x200) and file read (0x300), acts as an intermediate C2 relay, and includes an MD5 time-check validation and an administrative tasking mode. An anti-debug variant (aaamgrd) uses RC4 encryption, direct syscalls and ptrace-based anti-debugging checks. LittleFilch (libcommon.so) hooks SSL_read to intercept decrypted control-plane traffic and extracts AES-256 IPsec data-plane keying material by matching marker byte patterns. The harvested data is RSA-encrypted into /var/tmp/vdaemon.bin and staged for exfiltration inside DTLS 1.2 application-data records. The endpoint configuration is read from /var/tmp/vdaemon.conf, which is deleted after it is read.
Supporting components include rsshd (a ptrace-based injector) and conf_sshd (PID enumeration and injection orchestration). Persistence is achieved by modifying runit service launch scripts under /etc/sv/sshd/ and /etc/sv/aaamgr/ so they remount /rootfs.rw as executable and start the malicious loader chain, while preserving the legitimate service functions. Further TTPs documented by Talos are dynamic linker hijacking, packing, anti-debugging and system checks, timestomping and network sniffing.
Talos assesses with high confidence that UAT-11473's operating infrastructure overlaps considerably with Volt Typhoon's 'Silent Train' covert access network. The source does not state a nation-state, so attribution confidence here is MEDIUM and nation_state is left Unknown. Targeting covers space and satellite services, defense and aerospace technology, and policy research. The Talos report lists no network or hash IOCs, so no BeaconBeagle correlation was possible. Talos Snort coverage: SIDs 65938 and 65958 (CVE-2026-20127); 67387-67416 (Snort 2) and 7:44-7:73 (Snort 3) for the malicious artifacts.
MITRE ATT&CK techniques used in TL-2026-4677
Collection
Defense Evasion
T1027.002 Software Packing; T1036.004 Masquerade Task or Service; T1055.008 Ptrace System Calls; T1070.004 File Deletion; T1070.006 Timestomp; T1497.001 System Checks
Persistence
T1037 Boot or Logon Initialization Scripts; T1543 Create or Modify System Process
Credential Access
Execution
Command and Control
T1090.001 Internal Proxy; T1573.001 Symmetric Cryptography; T1573.002 Asymmetric Cryptography
Initial Access
T1190 Exploit Public-Facing Application
stealth
Affected products and versions in KeyDrift: UAT-11473 Activity on Cisco SD-WAN
- Cisco — Catalyst SD-WAN Controller (formerly vSmart)
Vulnerable versions: releases prior to 20.9.8.2; 20.11 - 20.12 prior to 20.12.6.1; 20.13 - 20.15 prior to 20.15.4.2; 20.16 - 20.18 prior to 20.18.2.1
Fixed in: 20.9.8.2; 20.12.6.1; 20.15.4.2; 20.18.2.1 - Cisco — Catalyst SD-WAN Manager (formerly vManage)
Vulnerable versions: releases prior to 20.9.8.2; 20.11 - 20.12 prior to 20.12.6.1; 20.13 - 20.15 prior to 20.15.4.2; 20.16 - 20.18 prior to 20.18.2.1
Fixed in: 20.9.8.2; 20.12.6.1; 20.15.4.2; 20.18.2.1
Remediation for KeyDrift: UAT-11473 Activity on Cisco SD-WAN
Patches
- Cisco Catalyst SD-WAN fixed releases per Cisco advisory cisco-sa-sdwan-rpa-EHchtZk: 20.9.8.2, 20.12.6.1, 20.15.4.2, 20.18.2.1; migrate releases earlier than 20.9 to a fixed release
Immediate actions
- Apply Cisco patches for CVE-2026-20127 on all Catalyst SD-WAN Controller and Manager instances (no workaround exists)
- Hunt SD-WAN controllers for the KeyDrift artifacts /tmp/system-vdaemon, /var/tmp/vdaemon.bin and /var/tmp/vdaemon.conf
- Inspect /etc/sv/sshd/ and /etc/sv/aaamgr/ runit scripts for unauthorized modification and for remounting of /rootfs.rw as executable
- Review /var/log/auth.log for 'Accepted publickey for vmanage-admin' from IPs that are not configured System IPs
- Deploy Talos Snort SIDs 65938, 65958, 67387-67416 (Snort 2) and 7:44-7:73 (Snort 3)
- Open a Cisco TAC case if unauthorized activity is found
Workarounds
- None available per Cisco advisory
Longer-term hardening
- Implement the Cisco Catalyst SD-WAN hardening guide
- Monitor controllers for post-compromise indicators such as unexpected library loads into vdaemon and ptrace activity
- Rotate IPsec data-plane keys and review control-plane credentials on any controller suspected of compromise
CVEs associated with KeyDrift: UAT-11473 Activity on Cisco SD-WAN
Weaknesses (CWE) in KeyDrift: UAT-11473 Activity on Cisco SD-WAN
Timeline of KeyDrift: UAT-11473 Activity on Cisco SD-WAN
- Cisco SD-WAN CVE-2026-20127 reported by other vendors as exploited in the wild since at least 2023 (year only; exact date not stated; attributed there to UAT-8616).
- Cisco Talos publishes its UAT-8616 advisory on CVE-2026-20127 exploitation: unauthorized peer connections, rogue account and SSH key manipulation, log clearing, and a software version downgrade to abuse CVE-2022-20775 for root before restoring the original version; Snort SIDs 65938 and 65958 released. Evidence of actor presence goes back at least three years.
- Cisco publishes advisory cisco-sa-sdwan-rpa-EHchtZk for CVE-2026-20127 (CVSS 10.0), confirming limited exploitation and no workaround.
- CISA adds CVE-2026-20127 to the KEV catalog and issues Emergency Directive ED-26-03 requiring federal agencies to inventory, patch and hunt in Cisco SD-WAN systems.
- Cisco updates its advisory noting that CVE-2026-20122 and CVE-2026-20128 were also exploited in the wild.
- Cisco Talos publishes 'Inside KeyDrift', analyzing historical UAT-11473 activity on Cisco SD-WAN, the KeyDrift framework (PolyFlame, LittleFilch) and overlap with Volt Typhoon's Silent Train infrastructure; Snort SIDs released.
Sources cited for KeyDrift: UAT-11473 Activity on Cisco SD-WAN
- Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
- Cisco Security Advisory: Catalyst SD-WAN Peering Authentication Bypass (cisco-sa-sdwan-rpa-EHchtZk)
- CISA Emergency Directive ED-26-03: Mitigate Vulnerabilities in Cisco SD-WAN Systems
- Talos: UAT-8616 and Cisco SD-WAN exploitation
- Tenable: CVE-2026-20127 Cisco Catalyst SD-WAN Controller/Manager Zero-Day Authentication Bypass
- The Hacker News: Cisco SD-WAN Zero-Day CVE-2026-20127
- Rapid7: Critical Cisco Catalyst vulnerability exploited in the wild (CVE-2026-20127)
- BleepingComputer: Critical Cisco SD-WAN bug exploited in zero-day attacks since 2023
- Qualys ThreatPROTECT: Cisco SD-WAN Controller and Manager Authentication Bypass (CVE-2026-20127)
Detection coverage for TL-2026-4677
As of 2026-10-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4677 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.