Cisco Talos researchers report that a newly identified threat group tracked as UAT-11473 is exploiting CVE-2026-20127, a maximum-severity authentication bypass in Cisco Catalyst SD-WAN Controllers, to install a custom malware framework called KeyDrift that maintains persistent access and steals cryptographic keying material. The activity targets space, satellite, defense, aerospace, and policy research organizations, and may overlap with Volt Typhoon's Silent Train covert access network.
BleepingComputer
A newly identified advanced persistent threat group tracked as UAT-11473 has been observed exploiting a maximum-severity vulnerability in Cisco Catalyst SD-WAN Controllers to deploy a custom malware framework named KeyDrift, according to researchers at Cisco Talos.
The flaw, tracked as CVE-2026-20127, is an authentication bypass that allows remote attackers to gain privileged access to Catalyst SD-WAN Controller and Manager and to add rogue peers. Cisco patched the issue in February 2026. The researchers noted that a cluster tracked as UAT-8616 has exploited the vulnerability as a zero-day since at least 2023, and recent research has also linked its exploitation to the Chinese state-sponsored hacking group Volt Typhoon.
Cisco Talos said the UAT-11473 cluster appears to overlap with Volt Typhoon's Silent Train covert access network, though the researchers stopped short of drawing definitive links. In a report released this week, Lumen researchers revealed that the Silent Train framework allowed Volt Typhoon to evade detection while conducting zero-day vulnerability attacks.
The attacks observed by Cisco Talos targeted space and satellite services, defense and aerospace technology, and policy research organizations. KeyDrift was designed to operate on Cisco SD-WAN controller instances, and Talos assesses with high confidence that the framework is built to provide long-term persistent access and automated exfiltration of sensitive keying material.
According to the researchers, KeyDrift operates inside SD-WAN control-plane processes and is capable of intercepting decrypted control traffic, extracting control-session metadata and data-plane keying material, and staging or transmitting the collected material using encrypted records.
The framework has two primary components, PolyFlame and LittleFilch, and Talos saw signs of ongoing development, including new anti-debugging mechanisms and varied process impersonation. PolyFlame runs inside legitimate vdaemon processes using modified service startup scripts and an injector for deployment. It supports command execution through a TinyShell-styled component, file uploads and downloads, and relaying communications between an attacker's command-and-control server and multiple peers.
LittleFilch is a control-session interception module that hooks SSL_read to inspect control-plane messages after they have been decrypted inside the controller. For predefined edge nodes, it extracts IP identifiers and a 32-byte field that Talos assesses to be AES-256 IPsec data-plane key material. The module uses RSA encryption to protect the collected information, saves it to /var/tmp/vdaemon.bin, and then transmits it over UDP to the attackers.
Talos believes with high confidence that KeyDrift is designed to maintain persistent access to Cisco SD-WAN controllers, intercept control-plane traffic, extract cryptographic keys, and securely stage or exfiltrate the stolen data. Cisco recommends that system administrators apply the available security updates for CVE-2026-20127 and consult the vendor's dedicated hardening guide for Catalyst SD-WAN deployments.