Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
Our summary
Cisco Talos has uncovered a state-linked actor, dubbed UAT-11473, that abused an authentication bypass flaw in Cisco SD-WAN Catalyst Controller instances, tracked as CVE-2026-20127, to gain unauthorized access to controller environments. Once inside, the attackers deployed a bespoke malware toolset named KeyDrift, built from components such as PolyFlame and LittleFilch, to hijack control-plane processes, harvest encryption keying material, and run covert backdoor/C2 relay functions. Victims span the space and satellite sector, defense and aerospace technology firms, and policy research organizations, and Talos links the group's infrastructure to Volt Typhoon's previously reported "Silent Train" access network. Cisco has already shipped a fix for CVE-2026-20127 along with hardening guidance, and Talos urges affected organizations to patch immediately and hunt for signs of compromise using the newly released Snort detection signatures.
Below is the opening; the full story is at Cisco Talos.
From Cisco Talos
Wednesday, October 28, 2026 17:32
- Cisco Talos has identified UAT-11473, a highly sophisticated advanced persistent threat (APT) actor, who exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances to bypass authentication and gain unauthorized access to affected systems.
- UAT-11473 then installed a custom malware framework we track as “KeyDrift” consisting of multiple components geared towards collecting sensitive keying information, acting as backdoors and intermediate command-and-control (C2) hosts.
- Observed targeting spans across space and satellite services, defense and aerospace technology, and policy research.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.