UAT-11473

Reported Context (4)

Cisco disclosed that this tracked APT actor weaponized CVE-2026-20127 to bypass authentication and gain unauthorized access to Cisco SD-WAN Catalyst Controller instances. Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls
Talos attributed historical attacks deploying KeyDrift on SD-WAN controllers to UAT-11473. Talos assessed with high confidence that its infrastructure overlapped considerably with Volt Typhoon’s Silent Train network, but did not say they were the same group. Cisco SD-WAN Zero-Day Activity Overlaps With Volt Typhoon’s Silent Train Network
Talos tracks the group behind KeyDrift as UAT-11473 and says it has targeted space and satellite services, defense and aerospace technology, and policy research. Cisco SD-WAN Flaw Exploited to Deploy Malware Designed to Steal Traffic Encryption Keys
Observed exploiting CVE-2026-20127 to deploy KeyDrift. Cisco Talos researchers assessed that the cluster appears to overlap with Volt Typhoon's Silent Train covert access network, but made no definitive link. Cisco SD-WAN Flaw Exploited to Deploy KeyDrift Malware

CVE (2)

Malware (4)

People (1)

Threat Actors (2)

MITRE ATT&CK (9)

Vendors (1)

Products (8)

Tools (2)

Industries (9)

Countries (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.