What happened
On October 28, 2026, Cisco Talos published its analysis of UAT-11473 and the KeyDrift malware framework in Cisco Catalyst SD-WAN controller environments. The actor exploited CVE-2026-20127 to bypass authentication and install components designed for persistent access, control-plane interception and collection of sensitive keying information. The underlying authentication-bypass vulnerability was disclosed in February 2026, but Lumen says Volt Typhoon was exploiting it by late 2025 and continued after disclosure.
KeyDrift comprises PolyFlame, rsshd, conf_sshd, a packed aaamgrd loader and LittleFilch. LittleFilch hooks SSL_read inside vdaemon, extracts assessed AES-256 IPsec data-plane key material and writes RSA-encrypted records to /var/tmp/vdaemon.bin. Talos observed /tmp/system-vdaemon, /var/tmp/vdaemon.conf, libdssl.so and libcommon.so as operational artefacts. The modules use process injection, modified runit service paths, dynamic-linker interception, packed loaders and encrypted staging.
Talos published Snort SIDs 65938 and 65958 for CVE-2026-20127, plus 67387 through 67416 and Snort 3 rules 7:44 through 7:73 for the malicious artefacts. Talos did not recover the /var/tmp/vdaemon.conf file, so its local and remote UDP endpoints were not published. Attribution posture: Cisco Talos tracks the actor as UAT-11473 and assesses high-confidence infrastructure overlap with Volt Typhoon’s Silent Train, but does not state that the two are the same group.
Why this matters now
SD-WAN controllers are privileged systems that distribute policy and cryptographic material across geographically dispersed networks. KeyDrift’s placement inside legitimate controller processes means conventional perimeter monitoring may see expected control traffic while malicious modules inspect decrypted content from within the trusted process. The decision is therefore about control-plane trust, not merely whether a software update is installed.
The collection of assessed AES-256 IPsec data-plane key material creates a consequence beyond persistent access to one appliance. Potentially exposed keys can affect the confidentiality assumptions of traffic protected or orchestrated by the controller. Organisations must determine which edges, tunnels and operational domains depended on each controller during the suspected exposure period before deciding the necessary rotation scope.
Lumen’s separate Silent Train research adds strategic context without proving that Cisco’s UAT-11473 label and Volt Typhoon are identical. It shows repeated targeting of management platforms, edge infrastructure and service providers using rapidly replaced relay devices. That operating model raises the value of internal artefacts, controller integrity checks and historical flow analysis when external command-and-control infrastructure is designed to disappear.
The decision for security leaders
Require a compromise review for controllers that were exposed or ran vulnerable software during the suspected activity period. Patching closes the authentication-bypass route but does not remove injected modules, modified service launchers, encrypted staging files or keys already collected by an attacker.
Define the controller-integrity threshold that triggers rebuild and key rotation. The decision should consider memory and filesystem findings, service modifications, unexplained control-plane traffic, exposure duration and the controller’s downstream reach. Do not leave rotation scope to ad hoc judgement during an active investigation.
Place SD-WAN controllers under the same privileged-system governance used for identity providers and hypervisor management planes. Restrict administrative reachability, retain high-value telemetry, monitor configuration integrity and ensure incident responders can isolate a controller without improvising business-continuity arrangements.
Evidence of closure
- Controller inventory identifies every role, version and management exposure.
- Forensic scans clear all published KeyDrift files and service modifications.
- Memory analysis finds no unauthorised injection into vdaemon processes.
- Snort and historical flow reviews produce an approved incident disposition.
The Security.io assessment
This story warrants inclusion because new Talos research revealed a purpose-built framework for extracting key material from inside trusted SD-WAN processes, while Lumen independently documented the covert relay infrastructure and historical zero-day use. The older vulnerability now carries a different enterprise decision: validate control-plane integrity and potentially rotate cryptographic material, rather than reporting patch completion alone.
The strongest evidence concerns malware mechanics, files, process hooks and detection rules. Attribution remains deliberately bounded. Infrastructure overlap supports correlation with Silent Train, but it does not collapse UAT-11473 and Volt Typhoon into one established identity. Leadership reporting should preserve that distinction while acting on the confirmed controller compromise techniques.
Questions for the morning meeting
- Can network teams enumerate every Catalyst SD-WAN controller, role, version and management exposure?
- Has any controller been checked for memory-resident implants rather than only patched?
- Which data-plane keys require rotation if a controller cannot be forensically cleared?
- Who owns incident escalation for compromise of the SD-WAN control plane?