Researchers have documented an advanced persistent threat group designated UAT-11473 leveraging CVE-2026-20127, a critical authentication-bypass vulnerability affecting Cisco Catalyst SD-WAN Controllers, to install a purpose-built malware called KeyDrift. The flaw, which Cisco addressed in February 2026, permits unauthenticated attackers to obtain administrative privileges on Catalyst SD-WAN Controller and Manager instances and introduce unauthorized peers into the network.
The vulnerability had been exploited in the wild since at least 2023 by the threat group UAT-8616 before a public patch became available. Cisco Talos researchers have also connected this exploitation activity to Volt Typhoon, a Chinese state-sponsored hacking operation. According to Talos findings, UAT-11473's activities appear to intersect with Volt Typhoon's "Silent Train" covert infrastructure, though researchers stopped short of confirming a direct relationship. A separate analysis from Lumen disclosed that the Silent Train framework enabled Volt Typhoon to maintain stealth while executing zero-day attacks.
KeyDrift deployment and capabilities
Cisco Talos observed the malware being deployed against organizations in space and satellite operations, defense and aerospace sectors, and policy research institutions. KeyDrift represents a custom-engineered malware platform built to run directly on Cisco SD-WAN controller systems.
Talos assesses with high confidence that the framework is designed to provide long-term persistent access and automated exfiltration of sensitive keying material.
Cisco Talos
The malware operates within SD-WAN control-plane processes and can intercept unencrypted control traffic, harvest control-session metadata, and obtain data-plane keying material. It then stages or transmits this harvested information using encrypted records.
The framework comprises two main functional modules: PolyFlame and LittleFilch. Talos researchers identified evidence of continuous development on both components, with new anti-debugging protections and changing process impersonation tactics appearing over time.
PolyFlame component
PolyFlame executes within legitimate vdaemon processes by modifying service startup configurations and employing an injector mechanism for installation. The module facilitates command execution through a TinyShell-style interface, manages file transfers in both directions, and acts as a relay between an attacker's command-and-control infrastructure and multiple compromised peers.
LittleFilch component
LittleFilch functions as a control-session interception module that hooks into SSL_read operations to examine control-plane messages after decryption occurs on the controller. From designated edge nodes, it retrieves IP identifiers and a 32-byte field that Talos assesses represents AES-256 IPsec data-plane key material. The stolen data undergoes RSA encryption for protection, gets written to /var/tmp/vdaemon.bin, and then transmits via UDP to the attacker infrastructure.
Talos maintains high confidence that KeyDrift's overall design objective centers on establishing durable access to Cisco SD-WAN controllers, monitoring control-plane communications, harvesting cryptographic keys, and securely exfiltrating the obtained sensitive material.
Mitigation guidance
Cisco advises network administrators to deploy available patches addressing CVE-2026-20127 and to reference the vendor's comprehensive hardening documentation specific to Catalyst SD-WAN environments.