# UAT-11473 Deploys KeyDrift Malware on Cisco SD-WAN via CVE-2026-20127

> Analyze UAT-11473 targeting Cisco SD-WAN controllers using CVE-2026-20127 and the custom KeyDrift framework for long-term persistence.

- Published: 2026-11-01T14:46:00.000Z
- Severity: high
- Category: Threat Intel
- Tags: Volt Typhoon, Cisco, Malware, Ransomware, UAT 11473
- CVEs: CVE-2026-20127 (CVSS 9.8)
- Author: Runtime Rebel Intel
- Primary source: https://blog.talosintelligence.com/uat-11473-keydrift/
- Canonical: https://runtimerebel.com/blog/uat-11473-deploys-keydrift-malware-on-cisco-sd-wan-via-cve-2026-20127

## Key points

- Immediate impact: APT actor UAT-11473 is exploiting authentication bypass vulnerabilities to gain unauthorized access and deploy custom persistent backdoors across critical sectors.
- Affected systems: Cisco SD-WAN Catalyst Controller instances running vulnerable firmware versions susceptible to CVE-2026-20127.
- Remediation: Apply official vendor patches immediately and audit SD-WAN controller environments for unauthorized runit service modifications.

## Overview of UAT-11473 Activity

Recent intelligence investigations by Cisco Talos have uncovered sophisticated campaigns conducted by the advanced persistent threat group designated as UAT-11473. According to [Cisco Talos](https://blog.talosintelligence.com/uat-11473-keydrift/), the [threat actor](/glossary#threat-actor) leverages the critical authentication bypass [vulnerability](/glossary#vulnerability) [CVE-2026-20127](/cve/cve-2026-20127) within Cisco SD-WAN Catalyst Controller instances. Following [initial access](/glossary#initial-access), the adversaries deploy a custom, modular [malware](/glossary#malware) framework tracked as "KeyDrift." 

Targeting patterns identified in this campaign span sensitive sectors, including space and satellite services, defense and aerospace technology, and policy research. Furthermore, analysts assess with high confidence that the operational infrastructure utilized by UAT-11473 shares significant overlap with the [Volt Typhoon](https://en.wikipedia.org/wiki/Volt_Typhoon) "Silent Train" covert access network. Security professionals researching how to detect [CVE](/glossary#cve)-2026-20127 [exploit](/glossary#exploit) activity must closely examine control-plane integrity and unexpected modifications to service startup scripts.

## Technical Analysis of the KeyDrift Framework

KeyDrift is specifically engineered to operate within Cisco SD-WAN control-plane environments, providing long-term [persistence](/glossary#persistence) and automated exfiltration capabilities for sensitive keying material. The architecture of KeyDrift consists of several interconnected components operating directly within controller daemon execution.

### PolyFlame Injection and Operation

The primary operational module of the framework is **PolyFlame**, a memory-resident implant deployed by modifying legitimate runit service paths. PolyFlame is injected into running `vdaemon` processes or masquerades as a packed `aaamgrd` loader variant. 

Key technical characteristics of PolyFlame include:
- **[API](/glossary#api) Interposition:** Hooks socket, DTLS, and runtime-linker behavior by intercepting functions such as `recvfrom`, `sendto`, `dlopen`, `dlsym`, `mprotect`, and parsing `/proc/%d/maps`.
- **In-Band [C2](/glossary#c2):** Rather than relying on traditional external beacons, PolyFlame utilizes in-band control over Cisco SD-WAN control-plane traffic. It replaces the legitimate `recvfrom` API call to intercept communication from command-and-control operators.
- **Time-Based Validation:** Evaluates local system time against an MD5 hash of a designated date sent by the operator before executing administrative tasks.

### LittleFilch Data Collection

Complementing PolyFlame, the **LittleFilch** module handles the collection and staging of sensitive data. It hooks `SSL_read` inside the `vdaemon` process to inspect decrypted control-plane buffers, extract cryptographic keying material for predefined edge nodes, and stage the harvested information locally in encrypted format.

## Actionable Mitigation and Detection Guidance

Defenders operating Cisco SD-WAN infrastructure should prioritize immediate remediation steps to counter this threat:

- **Apply Vendor Patches:** Update Cisco SD-WAN Catalyst Controller instances to the latest secure software versions that resolve [CVE-2026-20127](https://nvd.nist.gov/vuln/detail/CVE-2026-20127).
- **Audit Runit Launchers:** Inspect service startup scripts for unauthorized modifications, particularly alterations that remount `/rootfs.rw` as executable or invoke background scripts like `conf_sshd`.
- **Monitor Process Integrity:** Check for anomalous memory injections, unexpected dynamic library loads within `vdaemon`, and abnormal persistence mechanisms across core control-plane services.

**Related:** [Threat Actors Prefer Repeatable Playbooks Over Novel Exploits](/blog/threat-actors-prefer-repeatable-playbooks-over-novel-exploits), [SynkLoader Malware Steals Credentials in Microsoft Teams Phishing](/blog/synkloader-malware-steals-credentials-in-microsoft-teams-phishing)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/uat-11473-deploys-keydrift-malware-on-cisco-sd-wan-via-cve-2026-20127