UAT-11473 Deploys KeyDrift Malware on Cisco SD-WAN Controllers via CVE-2026-20127
Do Son 
TL;DR
Threat actors tracked as UAT-11473 exploited a critical authentication bypass flaw in Cisco SD-WAN Catalyst Controllers to deploy a custom implant called KeyDrift malware. Through this KeyDrift malware UAT-11473 operation, attackers injected malicious modules directly into control-plane processes to steal encryption keys and maintain hidden backdoors. Furthermore, investigators found strong infrastructure links connecting this campaign to Volt Typhoon’s covert relay network.
What Happened in the Intrusions
Attackers broke into vulnerable Cisco SD-WAN Catalyst Controller instances by exploiting CVE-2026-20127, an authentication bypass vulnerability. According to an investigation by Cisco Talos, the intruders used this initial access to install a multi-part espionage suite dubbed KeyDrift malware. Rather than using noisy external beacons, the framework operates directly inside legitimate SD-WAN control-plane processes.
“Talos assesses with high confidence that the framework is designed to provide long-term persistent access and automated exfiltration of sensitive keying material,” Cisco Talos researchers wrote. To survive reboots, the attackers altered runit service launch scripts for sshd and aaamgr. Specifically, the modified sshd script remounted the /rootfs.rw partition as executable and ran a background loader named conf_sshd. Next, this script located running vdaemon process IDs and used a ptrace injector named rsshd to load the main implant into memory.
Inside the PolyFlame and LittleFilch Modules
The core component of the KeyDrift malware is a memory-resident module named PolyFlame (libdssl.so). Once injected into vdaemon, PolyFlame hooks the recvfrom() API call to intercept in-band DTLS control-plane traffic without needing hardcoded callback domains or ports. To verify commands, PolyFlame compares an incoming MD5 hash from the operator against the local system date formatted as YYYY-MM-DD. When the hashes match, PolyFlame acts as either a TinyShell-style backdoor for running shell commands or an intermediate command-and-control (C2) relay that forwards traffic to peer nodes.
On affected vBond appliances, researchers also found a packed ELF64 variant of PolyFlame masquerading as the aaamgrd daemon. Unlike the legitimate Python-based Cisco aaamgr package, this compiled loader uses direct system calls, checks /proc/%d/status to evade debuggers, and deletes writable PAM configurations for sshd and login. Meanwhile, a second module called LittleFilch (libcommon.so) hooks the OpenSSL SSL_read function inside vSmart processes. LittleFilch inspects decrypted control buffers, extracts 32-byte AES-256 IPsec data-plane keys along with edge node IP addresses, and saves the RSA-encrypted records to /var/tmp/vdaemon.bin before sending them out over UDP.
Who Is Behind the Activity
Cisco Talos tracks the operators behind these intrusions as UAT-11473. While researchers treat UAT-11473 as a distinct cluster, network analysis revealed major ties to known state-sponsored infrastructure. “Talos assesses with high confidence that UAT-11473’s operating infrastructure overlaps considerably with Volt Typhoon’s ‘Silent Train’ covert access network,” the report stated. Additionally, the attackers used timestomping commands to match file modification dates on their malicious scripts with legitimate read-only system files.
Impact and Strategic Scale
Observed victims in the KeyDrift malware UAT-11473 campaign span space and satellite services, defense and aerospace technology, and policy research organizations. Because SD-WAN controllers manage routing and encryption across an entire enterprise wide-area network, compromising the vdaemon process gives attackers deep visibility. By harvesting OMP-distributed AES-256 IPsec keys via LittleFilch, the operators can potentially decrypt sensitive data-plane traffic moving between branch edge routers.
How Organizations Can Stay Protected
To defend against the KeyDrift malware, network administrators must immediately apply Cisco’s security updates for CVE-2026-20127 across all SD-WAN Catalyst Controller, vSmart, and vBond appliances. However, patching alone will not remove implants that are already running in memory. Therefore, security teams must audit /rootfs.rw/etc/sv/sshd/run and /rootfs.rw/etc/sv/aaamgr/run for unauthorized mount commands or references to conf_sshd and aaamgrd. Finally, defenders should check their appliances for rogue files such as /tmp/system-vdaemon, /var/tmp/vdaemon.bin, and libdssl.so, and rebuild any compromised controllers from trusted images.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
