Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware

{"title":"APT Group UAT-11473 Abuses Cisco SD-WAN Bug to Plant KeyDrift Malware","seo_title":"Cisco SD-WAN CVE-2026-20127 exploited: KeyDrift","seo_description":"Exploited in the wild: Cisco Catalyst SD-WAN Controller/Manager flaw CVE-2026-20127 deployed by UAT-11473 to install KeyDrift malware. Apply Cisco's patch now.","body_md":"Security researchers at Cisco Talos have uncovered a newly tracked threat actor, UAT-11473, leveraging CVE-2026-20127 — a critical authentication-bypass vulnerability in Cisco Catalyst SD-WAN Controller and Manager — to install a bespoke malware toolkit dubbed KeyDrift. The flaw, fixed by Cisco in February 2026, lets attackers gain elevated access and insert fraudulent peer nodes into SD-WAN environments; it had already been abused as a zero-day since 2023 by a separate cluster, UAT-8616, which investigators have tied to the Chinese state-backed group Volt Typhoon. Talos notes that UAT-11473's activity shows overlap with Volt Typhoon's "Silent Train" clandestine access infrastructure, though no firm attribution link has been confirmed. The campaign has struck organizations in satellite and space services, defense and aerospace, and policy research, using KeyDrift's two modules — PolyFlame and LittleFilch — to maintain persistent footholds, intercept decrypted control-plane traffic, steal AES-256 IPsec key material, and exfiltrate the data via encrypted channels. Cisco urges administrators to immediately deploy the available fix for CVE-2026-20127 and follow its hardening guidance for Catalyst SD-WAN deployments."}