Malware
PolyFlame
- First Reported
- Oct 29, 2026
- Latest Reported
- Oct 29, 2026
Reported Context (4)
- installed a custom malware framework we track as 'KeyDrift' consisting of multiple components [like PolyFlame and LittleFilch] geared towards collecting sensitive keying information, acting as backdoors and Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls
- Its main module, PolyFlame, works as a backdoor and can also relay commands to other hosts as an intermediate command-and-control (C2) node. A second module, LittleFilch, collects keying material that Talos believes Cisco SD-WAN Zero-Day Activity Overlaps With Volt Typhoon’s Silent Train Network
- script writes vdaemon's process IDs to a file, and a tool called rsshd injects KeyDrift's main module, PolyFlame, into each of those processes. Cisco SD-WAN Flaw Exploited to Deploy Malware Designed to Steal Traffic Encryption Keys
- KeyDrift has two primary components, PolyFlame and LittleFilch, for which Talos saw signs of ongoing development, including new anti-debugging mechanisms and varied process impersonation. Cisco SD-WAN Flaw Exploited to Deploy KeyDrift Malware
CVE (2)
Malware (3)
People (1)
Threat Actors (3)
MITRE ATT&CK (9)
Vendors (1)
Products (8)
Tools (2)
Industries (9)
Countries (2)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.