Cisco Talos detailed UAT-11473, a sophisticated APT that exploited CVE-2026-20127 — a CVSS 10.0 authentication-bypass flaw in Cisco Catalyst SD-WAN Controller, Manager and Validator components patched in February — to install a custom framework named KeyDrift on SD-WAN controllers. KeyDrift's PolyFlame module runs inside legitimate vdaemon processes as an in-memory backdoor and relay, while LittleFilch hooks SSL_read to extract control-session metadata and what Talos assesses as AES-256 IPsec data-plane key material, encrypts it with RSA and stages it for exfiltration. Talos said the activity is historical, targets space and satellite services, defence and aerospace, and policy research, and that UAT-11473's infrastructure "overlaps considerably" with Volt Typhoon's Silent Train covert network without being definitively the same group. Snort detection rules were released 28 October.

• Source article