As cited
Copy frozen at (site build).
threat intel
Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
Cisco Talos identified UAT-11473, an advanced persistent threat (APT) actor, exploiting CVE-2026-20127, a critical authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances, to deploy KeyDrift, a sophisticated custom malware framework. KeyDrift consists of multiple components including PolyFlame, a memory-resident module that intercepts control-plane traffic and acts as a backdoor, and LittleFilch, which extracts sensitive encryption keys from decrypted control sessions and stages them for exfiltration. The attack targeted organizations in space and satellite services, defense and aerospace technology, and policy research, with infrastructure overlapping considerably with Volt Typhoon's operations.
Why it matters: Organizations running Cisco SD-WAN Catalyst Controllers must apply CVE-2026-20127 patches immediately and monitor for KeyDrift indicators, as this critical vulnerability (CVSS 10.0) enables attackers to gain persistent access to sensitive network encryption keys and control infrastructure.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
Cisco Talos identified UAT-11473, an advanced persistent threat (APT) actor, exploiting CVE-2026-20127, a critical authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances, to deploy KeyDrift, a sophisticated custom malware framework. KeyDrift consists of multiple components including PolyFlame, a memory-resident module that intercepts control-plane traffic and acts as a backdoor, and LittleFilch, which extracts sensitive encryption keys from decrypted control sessions and stages them for exfiltration. The attack targeted organizations in space and satellite services, defense and aerospace technology, and policy research, with infrastructure overlapping considerably with Volt Typhoon's operations.
Why it matters: Organizations running Cisco SD-WAN Catalyst Controllers must apply CVE-2026-20127 patches immediately and monitor for KeyDrift indicators, as this critical vulnerability (CVSS 10.0) enables attackers to gain persistent access to sensitive network encryption keys and control infrastructure.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
Cisco Talos identified UAT-11473, an advanced persistent threat (APT) actor, exploiting CVE-2026-20127, a critical authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances, to deploy KeyDrift, a sophisticated custom malware framework. KeyDrift consists of multiple components including PolyFlame, a memory-resident module that intercepts control-plane traffic and acts as a backdoor, and LittleFilch, which extracts sensitive encryption keys from decrypted control sessions and stages them for exfiltration. The attack targeted organizations in space and satellite services, defense and aerospace technology, and policy research, with infrastructure overlapping considerably with Volt Typhoon's operations.
Why it matters: Organizations running Cisco SD-WAN Catalyst Controllers must apply CVE-2026-20127 patches immediately and monitor for KeyDrift indicators, as this critical vulnerability (CVSS 10.0) enables attackers to gain persistent access to sensitive network encryption keys and control infrastructure.
- Source published
- First seen by Cybersecurity Tracker