Overview of UAT-11473 Activity
Recent intelligence investigations by Cisco Talos have uncovered sophisticated campaigns conducted by the advanced persistent threat group designated as UAT-11473. According to Cisco Talos, the threat actor leverages the critical authentication bypass vulnerability CVE-2026-20127 within Cisco SD-WAN Catalyst Controller instances. Following initial access, the adversaries deploy a custom, modular malware framework tracked as “KeyDrift.”
Targeting patterns identified in this campaign span sensitive sectors, including space and satellite services, defense and aerospace technology, and policy research. Furthermore, analysts assess with high confidence that the operational infrastructure utilized by UAT-11473 shares significant overlap with the Volt Typhoon “Silent Train” covert access network. Security professionals researching how to detect CVE-2026-20127 exploit activity must closely examine control-plane integrity and unexpected modifications to service startup scripts.
Technical Analysis of the KeyDrift Framework
KeyDrift is specifically engineered to operate within Cisco SD-WAN control-plane environments, providing long-term persistence and automated exfiltration capabilities for sensitive keying material. The architecture of KeyDrift consists of several interconnected components operating directly within controller daemon execution.
PolyFlame Injection and Operation
The primary operational module of the framework is PolyFlame, a memory-resident implant deployed by modifying legitimate runit service paths. PolyFlame is injected into running vdaemon processes or masquerades as a packed aaamgrd loader variant.
Key technical characteristics of PolyFlame include:
- API Interposition: Hooks socket, DTLS, and runtime-linker behavior by intercepting functions such as
recvfrom,sendto,dlopen,dlsym,mprotect, and parsing/proc/%d/maps. - In-Band C2: Rather than relying on traditional external beacons, PolyFlame utilizes in-band control over Cisco SD-WAN control-plane traffic. It replaces the legitimate
recvfromAPI call to intercept communication from command-and-control operators. - Time-Based Validation: Evaluates local system time against an MD5 hash of a designated date sent by the operator before executing administrative tasks.
LittleFilch Data Collection
Complementing PolyFlame, the LittleFilch module handles the collection and staging of sensitive data. It hooks SSL_read inside the vdaemon process to inspect decrypted control-plane buffers, extract cryptographic keying material for predefined edge nodes, and stage the harvested information locally in encrypted format.
Actionable Mitigation and Detection Guidance
Defenders operating Cisco SD-WAN infrastructure should prioritize immediate remediation steps to counter this threat:
- Apply Vendor Patches: Update Cisco SD-WAN Catalyst Controller instances to the latest secure software versions that resolve CVE-2026-20127.
- Audit Runit Launchers: Inspect service startup scripts for unauthorized modifications, particularly alterations that remount
/rootfs.rwas executable or invoke background scripts likeconf_sshd. - Monitor Process Integrity: Check for anomalous memory injections, unexpected dynamic library loads within
vdaemon, and abnormal persistence mechanisms across core control-plane services.
Related: Threat Actors Prefer Repeatable Playbooks Over Novel Exploits, SynkLoader Malware Steals Credentials in Microsoft Teams Phishing