# KeyDrift: UAT-11473 Activity on Cisco SD-WAN (CVE-2026-20127)

> Cisco Talos analyzes historical activity by UAT-11473, an APT actor, against Cisco Catalyst SD-WAN controllers using the custom KeyDrift malware framework (PolyFlame and LittleFilch components). Talos assesses with high confidence that UAT-11473's operating infrastructure overlaps considerably with Volt Typhoon's 'Silent Train' covert access network; targeting includes space and satellite services, defense and aerospace technology, and policy research.

- **Published:** 2026-10-28T22:09:20Z
- **Last reviewed:** 2026-10-28T22:09:20Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4677
- **ID:** TL-2026-4677
- **Severity:** CRITICAL (CVSS 10)
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** UAT-11473
- **Detections:** 9 · **IOCs:** 13 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-20127

## Description

Cisco Talos (published 2026-10-28) describes KeyDrift, a custom malware framework built for Cisco SD-WAN controller environments and attributed to the APT cluster UAT-11473. KeyDrift provides persistent residence on the controller, in-band traffic access, and extraction of key material from decrypted control-plane messages. Talos reports the activity as historical and tied to CVE-2026-20127, an authentication bypass in the peering authentication mechanism of Cisco Catalyst SD-WAN Controller (formerly vSmart) and Manager (formerly vManage). Cisco disclosed CVE-2026-20127 on 2026-02-25 as exploited in the wild (CVSS 10.0); CISA added it to the KEV catalog and issued Emergency Directive ED-26-03 on 2026-02-26. Other vendor reporting attributes the CVE's exploitation since 2023 to a separate Talos-tracked cluster, UAT-8616; the Talos KeyDrift report is the source for UAT-11473 and the two designations should not be conflated without further evidence.

The framework has two main implants. PolyFlame (libdssl.so) is a memory-resident module injected into vdaemon processes; it interposes socket, DTLS and runtime-linker functions and supports arbitrary command execution (command code 0x100), file write (0x200) and file read (0x300), acts as an intermediate C2 relay, and includes an MD5 time-check validation and an administrative tasking mode. An anti-debug variant (aaamgrd) uses RC4 encryption, direct syscalls and ptrace-based anti-debugging checks. LittleFilch (libcommon.so) hooks SSL_read to intercept decrypted control-plane traffic and extracts AES-256 IPsec data-plane keying material by matching marker byte patterns. The harvested data is RSA-encrypted into /var/tmp/vdaemon.bin and staged for exfiltration inside DTLS 1.2 application-data records. The endpoint configuration is read from /var/tmp/vdaemon.conf, which is deleted after it is read.

Supporting components include rsshd (a ptrace-based injector) and conf_sshd (PID enumeration and injection orchestration). Persistence is achieved by modifying runit service launch scripts under /etc/sv/sshd/ and /etc/sv/aaamgr/ so they remount /rootfs.rw as executable and start the malicious loader chain, while preserving the legitimate service functions. Further TTPs documented by Talos are dynamic linker hijacking, packing, anti-debugging and system checks, timestomping and network sniffing.

Talos assesses with high confidence that UAT-11473's operating infrastructure overlaps considerably with Volt Typhoon's 'Silent Train' covert access network. The source does not state a nation-state, so attribution confidence here is MEDIUM and nation_state is left Unknown. Targeting covers space and satellite services, defense and aerospace technology, and policy research. The Talos report lists no network or hash IOCs, so no BeaconBeagle correlation was possible. Talos Snort coverage: SIDs 65938 and 65958 (CVE-2026-20127); 67387-67416 (Snort 2) and 7:44-7:73 (Snort 3) for the malicious artifacts.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1543 Create or Modify System Process
- T1037 Boot or Logon Initialization Scripts
- T1574.006 Dynamic Linker Hijacking
- T1055.008 Ptrace System Calls
- T1036.004 Masquerade Task or Service
- T1070.006 Timestomp
- T1070.004 File Deletion
- T1027.002 Software Packing
- T1497.001 System Checks
- T1040 Network Sniffing
- T1005 Data from Local System
- T1573.001 Symmetric Cryptography
- T1090.001 Internal Proxy
- T1573.002 Asymmetric Cryptography

## Sources

- [Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN](https://blog.talosintelligence.com/uat-11473-keydrift/)
- [Cisco Security Advisory: Catalyst SD-WAN Peering Authentication Bypass (cisco-sa-sdwan-rpa-EHchtZk)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk)
- [CISA Emergency Directive ED-26-03: Mitigate Vulnerabilities in Cisco SD-WAN Systems](https://www.cisa.gov/news-events/directives/ed-26-03)
- [Talos: UAT-8616 and Cisco SD-WAN exploitation](https://blog.talosintelligence.com/uat-8616-sd-wan/)
- [Tenable: CVE-2026-20127 Cisco Catalyst SD-WAN Controller/Manager Zero-Day Authentication Bypass](https://www.tenable.com/blog/cve-2026-20127-cisco-catalyst-sd-wan-controllermanager-zero-day-authentication-bypass)
- [The Hacker News: Cisco SD-WAN Zero-Day CVE-2026-20127](https://thehackernews.com/2026/02/cisco-sd-wan-zero-day-cve-2026-20127.html)
- [Rapid7: Critical Cisco Catalyst vulnerability exploited in the wild (CVE-2026-20127)](https://www.rapid7.com/blog/post/etr-critical-cisco-catalyst-vulnerability-exploited-in-the-wild-cve-2026-20127/)
- [BleepingComputer: Critical Cisco SD-WAN bug exploited in zero-day attacks since 2023](https://www.bleepingcomputer.com/news/security/critical-cisco-sd-wan-bug-exploited-in-zero-day-attacks-since-2023/)
- [Qualys ThreatPROTECT: Cisco SD-WAN Controller and Manager Authentication Bypass (CVE-2026-20127)](https://threatprotect.qualys.com/2026/02/26/cisco-sd-wan-controller-and-manager-authentication-bypass-vulnerability-cve-2026-20127/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4677