Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN

What it is

KeyDrift is a custom malware framework that Cisco Talos attributes to UAT-11473. The actor gained access through CVE-2026-20127, an authentication bypass in Cisco SD-WAN Catalyst Controller. Targeting spans space and satellite services, defense and aerospace technology, and policy research. Talos assesses with high confidence that the actor's infrastructure overlaps considerably with Volt Typhoon's "Silent Train" access network.

How it works

Persistence runs through Cisco SD-WAN runit service paths. In the sshd deployment, the actor adds two lines to the service run script before the legitimate sshd starts: one remounts /rootfs.rw executable, the other backgrounds a script called conf_sshd. That script lists running vdaemon PIDs, writes them to /tmp/system-vdaemon, and calls the injector rsshd to load PolyFlame (libdssl.so) into each one. A parallel aaamgr launcher on an affected vBond runs a packed loader, aaamgrd, directly. The legitimate aaamgr is a Python package, so a compiled ELF under /etc/sv/aaamgr/ is anomalous.

PolyFlame hooks recvfrom inside vdaemon and takes the C2 address from the real call. The C2 must send the MD5 of the device's local date (%Y-%m-%d), or the implant stops. It then reads an admin code:

• 1: send random bytes (likely a heartbeat).
• 2: choose TinyShell-style backdoor or intermediate C2.
• 3: set up the intermediate C2 handler.

The backdoor has no interactive shell. It uses 0x100 (/bin/sh -c), 0x200 (write file) and 0x300 (read file). The intermediate C2 is one-to-many: it talks to one C2 and many peers, using 0x403 to 0x408 to connect, relay, drop peers and set memory values. No hardcoded IPs, ports, domains or polling interval were recovered. Tasking appears to travel in-band over control-plane traffic.

aaamgrd is a statically linked ELF64 with no section headers, one RWE segment and an RC4-encrypted payload. It uses direct syscalls (ptrace, fork, mprotect and others). It exits if TracerPid in /proc/%d/status is nonzero. Talos also saw timestomping.

LittleFilch (libcommon.so) hooks SSL_read in vdaemon. It acts only on buffers larger than 0x18F bytes whose first byte is 0x07 and which contain three marker patterns. It RSA-encrypts the extracted keying material for predefined edge nodes and writes it to /var/tmp/vdaemon.bin. It can send the data over UDP as a DTLS 1.2 application-data style record. Its config, /var/tmp/vdaemon.conf, holds a local bind and a remote destination host and port, and is deleted after reading. Talos did not recover that file.

flowchart LR
  A[CVE-2026-20127 auth bypass] --> B[Modified runit run script]
  B --> C[conf_sshd + rsshd]
  C --> D[PolyFlame in vdaemon]
  D --> E[recvfrom hook: C2 tasking]
  D --> F[LittleFilch SSL_read hook]
  F --> G[/var/tmp/vdaemon.bin, UDP out]

What to do

• Apply Cisco's patches for CVE-2026-20127 and follow the Catalyst SD-WAN hardening guide.
• Hunt on controllers for conf_sshd, rsshd, libdssl.so, libcommon.so, /tmp/system-vdaemon, /var/tmp/vdaemon.bin and /var/tmp/vdaemon.conf. Also check for extra lines in the sshd runit run script and an aaamgrd ELF under /etc/sv/aaamgr/.
• Snort coverage: SIDs 65938 and 65958 for the CVE; Snort v2 SIDs 67387 through 67416 and Snort v3 SIDs 7:44 through 7:73 for the malware.
• If compromise is suspected, start incident response and open a Cisco TAC request.

Caveats

Talos says the observed module variants suggest active development. The page gives no patched version numbers in the text provided. Because no fixed C2 address was recovered and tasking is in-band, network blocklists are of limited use, so host artifacts matter more.