[CLSTR]
API
< Back to all clusters
[TECHNOLOGY] · Uganda · 3 sources

started · updated

Part of situation: KeyDrift malware targeting Cisco SD-WAN systems (2 clusters)

KeyDrift malware targets Cisco SD-WAN infrastructure

KeyDrift Cisco Catalyst SD-WAN UAT-11473 Volt Typhoon CVE-2026-20127

Researchers from Cisco Talos, Black Lotus Labs, and CERT-EU have identified a sophisticated malware campaign involving a custom framework known as KeyDrift. The campaign is attributed to a threat actor identified as UAT-11473, which has infrastructure overlapping with the Volt Typhoon-linked Silent Train botnet.

The attackers exploited CVE-2026-20127, a critical authentication bypass vulnerability in Cisco Catalyst SD-WAN Controllers, Manager, and Validator. While Cisco patched the flaw in February 2026, research indicates the vulnerability may have been exploited as a zero-day since 2023.

KeyDrift utilizes two primary components: PolyFlame, a backdoor injected into the vdaemon process memory for persistent access, and LittleFilch, a module designed to harvest AES-256 encryption keys from decrypted SD-WAN control traffic. This allows for the potential passive retrospective decryption of inter-site traffic. Confirmed targets include defense, aerospace, and space and satellite services.

Entities

Black Lotus Labs · CERT-EU · Cisco · Cisco Talos · UAT-11473 · Uganda National CERT and Coordination Center · Volt Typhoon

Claims

What the coverage asserts, and how many sources carry each claim.

  • [● 2 SOURCES] The campaign exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco Catalyst SD-WAN products. que.com · cert.ug
  • [○ 1 SOURCE] Cisco released a patch for the authentication bypass in February 2026. cert.ug
  • [○ 1 SOURCE] Confirmed targets of the campaign include space, satellite, defense, and aerospace sectors. cert.ug
  • [○ 1 SOURCE] The CVE-2026-20127 vulnerability has a CVSS score of 10.0. que.com
  • [● 2 SOURCES] The threat actor UAT-11473 is linked to the campaign using KeyDrift malware. que.com · cert.ug
  • [○ 1 SOURCE] The vulnerability may have been exploited as a zero-day starting in 2023. cert.ug
  • [○ 1 SOURCE] KeyDrift consists of the PolyFlame backdoor and the LittleFilch data harvesting module. que.com
  • [● 2 SOURCES] LittleFilch is designed to extract AES-256 encryption key material. que.com · cert.ug

Sources

CVE-2026-76473 Response Checklist: Inventory, Upgrade, Validate, Monitor [dev.to]
“KeyDrift” Malware Stole Cisco SD-WAN Encryption Keys for Years Before Detection (CVE-2026-20127) | Uganda National Computer Emergency Response Team-National Cert [cert.ug]
KeyDrift and NetamLoader Redefine State-Sponsored Malware Tactics - QUE.com [que.com]