KeyDrift: Talos reports UAT-11473 exploiting CVE-2026-20127 in Cisco Catalyst SD-WAN controllers to run an implant inside the control-plane daemon that collects data-plane keys, with infrastructure overlapping Volt Typhoon's Silent Train network

Cisco Talos reports that UAT-11473 exploited CVE-2026-20127, an authentication bypass in the peering authentication of Cisco Catalyst SD-WAN Controller (Cisco PSIRT, 2026-10-28), and then installed a custom framework it calls KeyDrift (Cisco Talos, 2026-10-28). CISA has listed the flaw in its Known Exploited Vulnerabilities catalog since 2026-02-25 (CISA KEV, 2026-10-28). Cisco's advisory (CVSS 10.0) says an unauthenticated remote attacker can log in as an internal high-privileged non-root user and reach NETCONF to change the SD-WAN fabric configuration, and that there is no workaround (Cisco PSIRT, 2026-10-28). Cisco's advisory, revised on 2026-10-28 to link Talos's post, says its PSIRT is aware of limited exploitation (Cisco PSIRT, 2026-10-28). Lumen's Black Lotus Labs reported in March that Volt Typhoon had exploited the flaw since late 2025 and after Cisco's February disclosure (Lumen Black Lotus Labs, 2026-03-16), and Talos assesses with high confidence that UAT-11473's operating infrastructure overlaps considerably with Volt Typhoon's Silent Train network (Cisco Talos, 2026-10-28).

KeyDrift runs inside the control-plane daemon. The actor edits the runit launchers of sshd and of a look-alike aaamgr service and remounts /rootfs.rw executable: the sshd launcher starts a script that injects the PolyFlame library into every running vdaemon process by ptrace, and the aaamgr launcher runs a packed PolyFlame loader directly (Cisco Talos, 2026-10-28). PolyFlame is tasked in-band over the control-plane traffic and offers a command, file-write and file-read backdoor and an intermediate command relay; Talos recovered no hardcoded address, port or domain (Cisco Talos, 2026-10-28). A second component, LittleFilch, hooks SSL_read in vdaemon and collects peer system addresses and 32-byte values Talos assesses to be OMP-distributed IPsec data-plane keys, writing them RSA-encrypted to /var/tmp (Cisco Talos, 2026-10-28). Talos lists observed targeting as space and satellite services, defense and aerospace technology, and policy research, calls the activity historical and does not say how many controllers were affected (Cisco Talos, 2026-10-28).

Triage: an aaamgr service that runs as a compiled ELF is the discriminator, because the legitimate component is a Python package and does not normally appear that way (Cisco Talos, 2026-10-28).