Researchers have identified a newly tracked threat cluster, UAT-11473, exploiting the critical Cisco Catalyst SD-WAN vulnerability CVE-2026-20127 to deploy a custom malware framework called KeyDrift. The framework is designed to maintain long-term access to SD-WAN controllers, intercept decrypted control-plane traffic, and extract sensitive IPsec keying material from targeted organizations.
Cisco patched CVE-2026-20127 in February 2026. The maximum-severity authentication bypass flaw allows remote attackers to gain privileged access to Catalyst SD-WAN controllers and managers and add rogue peers.
UAT-8616 has reportedly exploited the vulnerability as a zero-day since at least 2023. Recent research has linked that activity to Bolt Typhoon, a state-sponsored hacking group associated with China.
Cisco Talos researchers said the UAT-11473 activity appears to overlap with Bolt Typhoon’s “Silent Train” covert access network, although they found no definitive link between the threat cluster and the group.
In a report released by Lumen the previous day, researchers said the Silent Train framework helps Bolt Typhoon evade detection while using zero-day exploits.
KeyDrift malware framework targets SD-WAN controllers
The attacks observed by Cisco researchers targeted organizations in the space and satellite services, defense and aerospace technology, and policy research sectors. The attackers used KeyDrift, a custom framework built to run on Cisco SD-WAN controller instances.
“Talos has high confidence that this framework is designed to provide long-term persistent access and automated extraction of sensitive keying material,” Cisco Talos explained.
“KeyDrift operates within the SD-WAN control plane process and can intercept decrypted control traffic, extract control session metadata and data plane keying material, and stage or transmit the collected material using encrypted records.”
KeyDrift consists of two primary components, PolyFlame and LittleFilch. Talos has also observed indications that the framework remains under development, including new anti-debugging mechanisms and various forms of process impersonation.
PolyFlame and LittleFilch components
PolyFlame runs inside a regular vdaemon process. The attackers deploy it using a modified service startup script and an injector.
The component can execute commands, upload and download files, and relay communications between an attacker’s command-and-control (C2) server and multiple peers through TinyShell-style components.
LittleFilch is a control-session interception module that hooks SSL_read to inspect decrypted control-plane messages inside the controller.
For predefined edge nodes, the malware extracts the IP identifier and a 32-byte field that Talos assesses to be AES-256 IPsec data-plane key material.
KeyDrift protects the collected information with RSA encryption, stores it in /var/tmp/vdaemon.bin, and sends it to the attacker over UDP.
Talos believes the framework is designed to preserve access to Cisco SD-WAN controllers, intercept control-plane traffic, obtain cryptographic keys, and securely stage or exfiltrate stolen data.
Cisco urges customers to apply security updates
Cisco recommends that system administrators install the available security updates for CVE-2026-20127. Administrators should also consult the vendor’s dedicated hardening guide for Catalyst SD-WAN deployments.
The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.
The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com