Skip to content

Back to the catalog

Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware
bleepingcomputer.comarticle

Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware

UAT-11473, a newly tracked APT cluster, exploits CVE-2026-20127, a max-severity authentication bypass in Cisco Catalyst SD-WAN Controllers (patched February 2026), to deploy the KeyDrift malware framework. KeyDrift's PolyFlame runs inside vdaemon processes, and LittleFilch hooks SSL_read to extract AES-256 IPsec keying material, saved to /var/tmp/vdaemon.bin and sent over UDP. Targets include space, defense and policy organizations. Talos sees overlap with Volt Typhoon's Silent Train network but makes no definitive link.

TL;DR Reports Cisco Talos findings on UAT-11473 using CVE-2026-20127 to install KeyDrift, which steals IPsec keys from Cisco SD-WAN controllers.
Open original ↗
Document

What it is

Cisco Talos reports a newly tracked cluster, UAT-11473, exploiting CVE-2026-20127 in Cisco Catalyst SD-WAN Controller and Manager to install KeyDrift, a custom framework built to run on SD-WAN controller instances. Cisco patched the flaw in February 2026. It is a max-severity authentication bypass that gives remote attackers privileged access and lets them add rogue peers.

How it works

KeyDrift has two parts, and Talos saw signs of ongoing development in both, including new anti-debugging mechanisms and varied process impersonation.

  • PolyFlame runs inside legitimate vdaemon processes, deployed through modified service startup scripts and an injector. It offers command execution through a TinyShell-styled component, file upload and download, and relaying between the C2 server and multiple peers.
  • LittleFilch hooks SSL_read to read control-plane messages after the controller has decrypted them. For predefined edge nodes it pulls IP identifiers and a 32-byte field that Talos assesses to be AES-256 IPsec data-plane key material. The data is RSA-encrypted, written to /var/tmp/vdaemon.bin, then sent over UDP.

Talos assesses with high confidence that the aim is long-term persistent access and automated exfiltration of keying material.

Preconditions / Affected

Affected systems are Catalyst SD-WAN Controllers and Managers that were unpatched for CVE-2026-20127. The page gives no version numbers. Observed targets were space and satellite services, defense and aerospace technology, and policy research organizations.

What to do

Apply Cisco's security updates for CVE-2026-20127 and follow Cisco's hardening guide for Catalyst SD-WAN. The page names no detection queries. Its named artifacts are:

  • /var/tmp/vdaemon.bin
  • modified service startup scripts
  • unexpected code inside vdaemon processes
  • unexplained UDP egress from controllers
  • rogue SD-WAN peers

Caveats

A separate cluster, UAT-8616, has exploited this flaw as a zero-day since at least 2023, so a controller patched in February 2026 may already have been compromised. Recent research links UAT-8616's exploitation to Volt Typhoon. Talos sees overlap between UAT-11473 and Volt Typhoon's "Silent Train" covert access network (described in a Lumen report) but makes no definitive link. The page treats the 32-byte field as assessed, not confirmed, key material.

Organisations named here

  • KeyDrift
  • LittleFilch
  • Lumen
  • PolyFlame
  • Silent Train
  • TinyShell
  • UAT-11473
  • UAT-8616

CVEs named here

  • CVE-2026-20127

Technologies named here

  • Cisco Talos
  • Cisco Catalyst SD-WAN Manager
  • Cisco Catalyst SD-WAN
  • Cisco Catalyst SD-WAN Controller (CVE-2026-20127, patched February 2026)
  • Cisco hardening guide for Catalyst SD-WAN
  • Cisco SD-WAN controller instances (targeted by KeyDrift; vdaemon processes)
  • Lumen report
  • The Blue Report 2026

Techniques named here

  • Authentication bypass
  • Anti-debugging
  • Zero-day exploitation
  • Command and control relaying
  • Cryptographic key extraction
  • Encrypted staging and exfiltration
  • Function hooking (SSL_read)
  • Process impersonation

Threat actors named here

  • Volt Typhoon
  • KeyDrift (custom malware framework for Cisco SD-WAN controller instances; long-term persistent access and automated exfiltration of keying material)
  • LittleFilch (KeyDrift component; control-session interception module hooking SSL_read)
  • PolyFlame (KeyDrift component; runs inside legitimate vdaemon processes, supports command execution via a TinyShell-styled component, file upload and download, and C2 relaying between attacker server and multiple peers)
  • Silent Train (Volt Typhoon covert access network and framework, described in a Lumen report as allowing detection evasion during zero-day attacks)
  • TinyShell (styled component used by PolyFlame for command execution)
  • UAT-11473 (newly identified APT group; cluster overlaps with Volt Typhoon's Silent Train covert access network, no definitive link made by Cisco Talos)
  • UAT-8616 (exploited CVE-2026-20127 as a zero-day since at least 2023; exploitation also linked by recent research to Volt Typhoon)

Related in Threat Intel