Cisco Talos has detailed a sophisticated state-style attacker it tracks as UAT-11473, which broke into
Cisco SD-WAN Catalyst (vManage) controllers by abusing an authentication bypass flaw, CVE-2026
20127, and then installed a custom malware framework called KeyDrift. KeyDrift hides inside the
controller’s own network processes, reads control traffic that has already been decrypted, and steals
the secret keys that protect the SD-WAN network, sending them out in encrypted form. Observed
targets are space and satellite services, defence and aerospace, and policy research. Talos assesses
with high confidence that the attacker’s infrastructure overlaps with Volt Typhoon’s Silent Train network.
Cisco has patched the flaw. Any affected controller should be treated as fully compromised, not just
cleaned.
1. Campaign Timeline
Talos identified UAT-11473, a highly capable APT actor, exploiting CVE-2026-20127, an authentication bypass in Cisco
SD-WAN Catalyst Controller instances, to gain unauthorised access, then installing the KeyDrift framework for long-term
persistence and automated theft of keying material. Observed targeting spans space and satellite services, defence and
aerospace technology, and policy research. Talos assesses with high confidence that UAT-11473’s operating
infrastructure overlaps considerably with Volt Typhoon’s Silent Train covert access network. Observed variation across
the KeyDrift modules and deployment methods points to a framework still under active development.
2. Attack Details
- Initial Access: UAT-11473 exploited CVE-2026-20127, an authentication bypass in Cisco SD-WAN Catalyst Controller instances, to reach affected systems without valid credentials.
- Persistence and Injection: The actor modified Cisco SD-WAN runit service scripts under /etc/sv/sshd/ and /etc/sv/aaamgr/, remounted /rootfs.rw executable, and ran conf_sshd, which enumerates vdaemon process IDs and calls the rsshd injector to ptrace-inject the PolyFlame module (libdssl.so) into each legitimate vdaemon process.
- Collection: The LittleFilch module (libcommon.so) hooks SSL_read inside vdaemon, inspects decrypted control-plane buffers, and extracts vEdge public and system IP addresses and assessed OMP-distributed AES-256 IPsec data-plane keys for a predefined list of edge nodes.
- Staging and Exfiltration: LittleFilch RSA-encrypts the recovered keying material and writes it to /var/tmp/vdaemon.bin, then can send it over UDP in a DTLS 1.2 application-data style record, using local and remote endpoints from a vdaemon.conf file it deletes after reading.
3. Payload Capabilities
- PolyFlame in-band backdoor: PolyFlame runs inside vdaemon and hooks recvfrom, so it is tasked in-band over SD WAN control-plane traffic with no fixed external beacon. It gates execution on a date check, comparing an MD5 of the device’s current date against a value from the C2, then runs a TinyShell-style backdoor supporting command execution via /bin/sh -c, file write and file read.
- Intermediate C2 multiplexer: PolyFlame can switch into an intermediate C2 role that connects to one upstream C2 while relaying commands and responses to and from many peer implants, letting the actor pivot through controllers rather than beacon out directly.
- aaamgrd loader and evasion: A PolyFlame variant masquerades as the Cisco aaamgr service as a statically linked ELF with an RC4-encrypted embedded payload, uses direct syscalls, checks TracerPid to exit under a debugger, deletes PAM overlay configs, and timestomps files to blend in.
4. Adversary Toolkit
| TOOL / INDICATOR | TYPE | FUNCTION |
| PolyFlame (libdssl.so) | Memory-resident ELF module | In-band control-plane interception, TinyShell-style backdoor, and intermediate C2 inside vdaemon. |
| LittleFlitch (libcommon.so) | OpenSSL SSL_read hook | Extracts control-session IDs and assessed AES-256 data-plane keys from decrypted control traffic. |
| rsshd | Ptrace injector | Injects libdssl.so into vdaemon processes by PID (MITRE T1055.008). |
| conf_sshd | Shell loader script | Enumerates vdaemon PIDs, records them in /tmp/system-vdaemon, and drives rsshd injection. |
| aaamgrd | Packed ELF loader (RC4) | Decrypts and runs an embedded PolyFlame payload; anti-debug and PAM tampering. |
5. Recommendations
- Apply Cisco’s patches for CVE-2026-20127 and follow the Cisco Catalyst SD-WAN hardening guide, prioritising internet-reachable Controller, vSmart and vBond instances.
- Hunt on SD-WAN controllers for KeyDrift artifacts: libdssl.so or libcommon.so loaded inside vdaemon, rogue runit services under /etc/sv/sshd/ and /etc/sv/aaamgr/, conf_sshd, rsshd, /tmp/system-vdaemon, and /var/tmp/vdaemon.bin or vdaemon.conf.
- Check for injection and tampering: ptrace injection into vdaemon, an aaamgr service running as a compiled ELF instead of the normal Python package, /rootfs.rw remounted executable, deleted PAM overlay configs, and timestomped files.
- If any artifact is found, treat the controller as fully compromised: activate incident response, engage the Cisco Technical Assistance Center, and rotate SD-WAN control-plane and data-plane keying material, since LittleFilch steals distributed IPsec keys.
- Restrict controller management interfaces to trusted networks, enforce strong authentication, and monitor for anomalous vdaemon behaviour and unexpected DTLS or UDP egress from SD-WAN controllers.
6. Sources
- https://blog.talosintelligence.com/uat-11473-keydrift
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.