Keydrift Malware

Cisco Talos: UAT-11473 exploits SD-WAN flaw CVE-2026-20127 to deploy KeyDrift malware

Cisco Talos researchers identified a new threat group, UAT-11473, exploiting a maximum-severity authentication-bypass vulnerability in Cisco Catalyst SD-WAN Controllers and Managers, patched in February 2026, to install a custom malware framework called KeyDrift. The attacks targeted space and satellite services, defense and aerospace firms, and policy research organizations, aiming to steal encryption keys and control-plane traffic. KeyDrift comprises two components, PolyFlame and LittleFilch, which Talos says are under active development with new evasion techniques.