A sophisticated espionage crew broke into Cisco SD-WAN controllers and quietly lived inside the software that runs them, harvesting the encryption keys that protect traffic between an organization's branch sites. Cisco Talos tracks the actor as UAT-11473 and its custom malware framework as KeyDrift, and says observed targeting spanned space and satellite services, defense and aerospace technology, and policy research.
The way in was CVE-2026-20127, the CVSS 10 authentication bypass in Cisco Catalyst SD-WAN Controller and Manager that has sat on CISA's Known Exploited Vulnerabilities list since February. Talos describes the report as an analysis of historical UAT-11473 activity, so this is a detailed look back at how one actor used that flaw rather than a new wave of attacks. We covered the original zero-day exploitation in March.
A borrowed network with a familiar owner
Talos assesses with high confidence that UAT-11473's operating infrastructure overlaps considerably with the "Silent Train" covert access network it associates with Volt Typhoon. Talos presents that as shared infrastructure. It does not state that UAT-11473 and Volt Typhoon are the same group, and neither do we.
Living inside the controller, not beside it
Most implants beacon out to a server on the internet. KeyDrift does not. Its main component, PolyFlame, is injected into the legitimate vdaemon process that handles SD-WAN control-plane traffic, so the operator's tasking rides inside the network's own management traffic. Talos recovered no hardcoded IP addresses, ports, domains or polling intervals from the samples it analyzed.
Persistence comes from the appliance's runit service scripts. In one deployment the attacker added two lines to the sshd launcher that remount the /rootfs.rw overlay as executable and start a script, conf_sshd, which records vdaemon's process IDs and calls an injector named rsshd to load PolyFlame (libdssl.so) into each one. On an affected vBond appliance, a second variant masqueraded as the aaamgr service: a packed binary named aaamgrd carrying an RC4-encrypted payload, with a check that exits if a debugger is attached. Talos also found signs of timestomping.
Once resident, PolyFlame acts either as a TinyShell-style backdoor (run commands, read files, write files) or as an intermediate relay that passes the operator's commands on to other peers. It stops executing unless the command server sends an MD5 hash that matches the device's own current date.
The encryption keys are the prize
A second module, LittleFilch (libcommon.so), hooks SSL_read inside vdaemon and inspects decrypted control-plane messages. From them it pulls each edge router's public IP, its system IP and a 32-byte field that Talos assesses to be the AES-256 IPsec key material the controller distributes for the data plane. The records are RSA-encrypted, written to /var/tmp/vdaemon.bin and can be sent out over UDP formatted like DTLS 1.2 application data. The module's configuration file, /var/tmp/vdaemon.conf, is deleted after it is read, and Talos was not able to recover one.
Talos assesses with high confidence that the framework is built for long-term access and automated theft of keying material, and says variations across the samples suggest it is still under active development.
Patch CVE-2026-20127, then hunt for these artifacts
Cisco has released patches for CVE-2026-20127 and a hardening guide for Catalyst SD-WAN deployments. Talos strongly recommends applying both, monitoring for post-compromise activity, and contacting Cisco TAC if anything turns up. Host artifacts worth checking on controllers and vBond appliances:
- Unexpected changes to the runit scripts under /etc/sv/sshd/, or a compiled ELF binary under /etc/sv/aaamgr/
- The files /tmp/system-vdaemon, /var/tmp/vdaemon.bin or /var/tmp/vdaemon.conf
- libdssl.so or libcommon.so loaded into a vdaemon process
Snort SIDs 65938 and 65958 cover exploitation of the vulnerability. SIDs 67387 to 67416 (Snort 2) and 7:44 to 7:73 (Snort 3) cover the KeyDrift artifacts.
An SD-WAN controller hands out the keys for an entire network, which makes it one of the most valuable boxes an intruder can sit on. KeyDrift is a reminder that it deserves the same scrutiny as a domain controller.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.