GoKawiilCisco Talos: UAT-11473 exploits SD-WAN flaw CVE-2026-20127 to deploy KeyDrift malware
Cisco Talos researchers identified a new threat group, UAT-11473, exploiting a maximum-severity authentication-bypass vulnerability in Cisco Catalyst SD-WAN Controllers and Managers, patched in February 2026, to install a custom malware framework called KeyDrift. The attacks targeted space and satellite services, defense and aerospace firms, and policy research organizations, aiming to steal encryption keys and control-plane traffic. KeyDrift comprises two components, PolyFlame and LittleFilch, which Talos says are under active development with new evasion techniques.
GoKawiil's interpretation of the reporting above, not reported fact.
The targeting of defense, aerospace and satellite organizations suggests the campaign could be aimed at long-term espionage rather than immediate disruption, since KeyDrift is designed for persistent access and stealthy data exfiltration. Talos notes overlaps between UAT-11473's infrastructure and Volt Typhoon's 'Silent Train' network, which a separate Lumen report links to Chinese state-sponsored operations, though researchers stop short of confirming a direct connection. Continued development of anti-debugging and impersonation features implies the attackers are actively refining the malware to evade detection in critical network infrastructure.
- UAT-11473 exploited CVE-2026-20127, a max-severity Cisco SD-WAN authentication bypass patched in February 2026.
- The KeyDrift malware framework, built from PolyFlame and LittleFilch components, steals encryption keys and control-plane data from SD-WAN controllers.
- Talos sees possible but unconfirmed overlap between UAT-11473 and the Volt Typhoon-linked 'Silent Train' covert access network.
YubiKey 5 Series Security Key — With nation-state APT groups exploiting authentication-bypass flaws to hijack privileged network access, hardware-backed multi-factor authentication is more critical than ever for admins and security teams. A YubiKey adds a physical layer of protection that credential-based attacks like this one can't easily bypass, helping safeguard critical infrastructure logins.”,
See YubiKey 5 Series Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-10-29
Published there as: “Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.