Cisco SD-WAN Flaw Exploited to Deploy KeyDrift Malware
Summary
Cisco Talos reports that UAT-11473 exploited CVE-2026-20127 to deploy KeyDrift on Cisco SD-WAN controllers. The framework can intercept control traffic and collect keying material; Cisco recommends applying the available update.
Key points
- Cisco Talos observed UAT-11473 exploiting the authentication-bypass flaw CVE-2026-20127 in Cisco Catalyst SD-WAN Controllers.
- The flaw allows remote attackers to gain privileged access to SD-WAN Controller and Manager systems and add rogue peers; Cisco patched it in February 2026.
- KeyDrift has two components: PolyFlame, which supports command execution, file transfer and communications relaying, and LittleFilch, which intercepts decrypted control-session messages.
- Talos says LittleFilch can collect control-session metadata and what it assesses to be AES-256 IPsec data-plane key material, then encrypt and transmit the collected information.
- Talos assesses with high confidence that KeyDrift is designed for persistent access and automated collection of sensitive keying material.
- Talos said UAT-11473 appears to overlap with Volt Typhoon’s “Silent Train” network but made no definitive link. The article also says UAT-8616 exploited the flaw as a zero-day since at least 2023.
- Cisco recommends applying the available security updates for CVE-2026-20127 and consulting its Catalyst SD-WAN hardening guide.
Article Details
- Attack Vectors
- UAT-11473 was observed exploiting the authentication-bypass vulnerability CVE-2026-20127 in Cisco Catalyst SD-WAN Controllers to deploy KeyDrift.
- KeyDrift's PolyFlame component runs inside legitimate vdaemon processes, deployed using modified service startup scripts and an injector.
- LittleFilch hooks SSL_read to inspect decrypted control-plane messages, extract session metadata and keying material, and transmit collected material over UDP to the attackers.
- Defensive Notes
- Cisco recommends applying the available security updates for CVE-2026-20127.
- Cisco recommends consulting its hardening guide for Catalyst SD-WAN deployments.
MITRE ATT&CK
CVE
Threat Actors
UAT-11473Observed exploiting CVE-2026-20127 to deploy KeyDrift. Cisco Talos researchers assessed that the cluster appears to overlap with Volt Typhoon's Silent Train covert access network, but made no definitive link.UAT-8616Reportedly exploited CVE-2026-20127 as a zero-day since at least 2023.Volt TyphoonRecent research linked exploitation of CVE-2026-20127 to Volt Typhoon; the article does not establish a definitive link between Volt Typhoon and UAT-11473.
Malware
KeyDriftHackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malwareLittleFilchKeyDrift has two primary components, PolyFlame and LittleFilch, for which Talos saw signs of ongoing development, including new anti-debugging mechanisms and varied process impersonation.PolyFlameKeyDrift has two primary components, PolyFlame and LittleFilch, for which Talos saw signs of ongoing development, including new anti-debugging mechanisms and varied process impersonation.
Vendors
Products
Industries
defense and aerospace technologyThe attacks Cisco researchers observed targeted space and satellite services, defense and aerospace technology, and policy research organizations, using the KeyDrift malware, which is a custom malware framework designedPolicy researchresearchers observed targeted space and satellite services, defense and aerospace technology, and policy research organizations, using the KeyDrift malware, which is a custom malware framework designed to operate onspace and satellite servicesThe attacks Cisco researchers observed targeted space and satellite services, defense and aerospace technology, and policy research organizations, using the KeyDrift malware, which is a custom malware framework designed