Cybersecurity researchers have uncovered a new APT group, **UAT-11473**, actively leveraging a zero-day vulnerability in **Cisco Catalyst SD-WAN Controllers** to deploy a custom malware framework named **KeyDrift**. The vulnerability, identified as **CVE-2026-20127**, is a maximum-severity authentication-bypass flaw that **Cisco** patched in February 2026. ### The Zero-Day Exploitation **CVE-2026-20127** allows remote attackers to gain privileged access to **Catalyst SD-WAN Controller** and **Manager** instances, enabling them to add rogue peers. While **Cisco** addressed the flaw, evidence suggests that another group, **UAT-8616**, has been exploiting this vulnerability as a zero-day since at least 2023. Recent research also links its exploitation to the Chinese state-sponsored hacking group **Volt Typhoon**. **Cisco Talos** researchers, who reported on the **UAT-11473** activity, note that this threat cluster appears to overlap with **Volt Typhoon**'s 'Silent Train' covert access network, although no definitive links have been established. A recent report by **Lumen** highlighted that the **Silent Train** framework allowed **Volt Typhoon** to evade detection during zero-day vulnerability attacks. ### Deploying KeyDrift The attacks observed by **Cisco** researchers specifically targeted organizations in space and satellite services, defense and aerospace technology, and policy research. The core of these operations is the **KeyDrift** malware, a bespoke framework meticulously designed to operate within **Cisco SD-WAN Controller** instances. "Talos assesses with high confidence that the framework is designed to provide long-term persistent access and automated exfiltration of sensitive keying material," explained **Cisco Talos** in their report. **KeyDrift** operates within SD-WAN control-plane processes, enabling it to intercept decrypted control traffic, extract control-session metadata, and capture data-plane keying material. This collected information is then staged or transmitted using encrypted records. ### KeyDrift's Components: PolyFlame and LittleFilch **KeyDrift** comprises two primary components: **PolyFlame** and **LittleFilch**. Researchers have noted signs of ongoing development for both, including new anti-debugging mechanisms and varied process impersonation techniques. * **PolyFlame** runs inside legitimate `vdaemon` processes, utilizing modified service startup scripts and an injector for deployment. It provides capabilities for command execution via a **TinyShell**-styled component, file uploads and downloads, and relaying communications between an attacker’s command-and-control (C2) server and multiple peers. * **LittleFilch** is a control-session interception module. It hooks `SSL_read` to inspect control-plane messages after they have been decrypted within the controller. For predefined edge nodes, it extracts IP identifiers and a 32-byte field, which **Talos** assesses to be **AES-256 IPsec** data-plane key material. This sensitive information is protected with **RSA encryption**, saved to `/var/tmp/vdaemon.bin`, and subsequently transmitted to the attackers over UDP. **Cisco Talos** maintains high confidence that **KeyDrift**'s primary objectives are to maintain persistent access to **Cisco SD-WAN Controllers**, intercept control-plane traffic, extract cryptographic keys, and securely exfiltrate stolen data. ### Recommendations To mitigate the risks posed by **UAT-11473** and similar threats, **Cisco** strongly recommends that system administrators apply all available security updates for **CVE-2026-20127**. Additionally, consulting **Cisco**’s dedicated hardening guide for **Catalyst SD-WAN** deployments is crucial for enhancing the security posture of these critical network infrastructures.