UAT-11473 KeyDrift malware targets Cisco SD-WAN controllers for key exfiltration

1. Executive summary

Cisco Talos has attributed historical intrusions against Cisco Catalyst SD-WAN Controller deployments to an actor it tracks as UAT-11473, which used an authentication bypass, CVE-2026-20127, to gain access and then installed a custom framework, KeyDrift, inside the SD-WAN control plane. KeyDrift hooks the legitimate vdaemon process and extracts data-plane IPsec keying material from decrypted control-session traffic, staging it encrypted for exfiltration. Talos assesses with high confidence that UAT-11473's infrastructure overlaps Volt Typhoon's "Silent Train" covert access network, but UAT-11473 has no MITRE ATT&CK profile and the attribution is unconfirmed. No CVSS score, severity rating, EPSS score or CISA KEV entry for CVE-2026-20127 is available in the reference data supplied to Adverse Trace, so this advisory does not assign one. EMEA financial services firms running Cisco Catalyst SD-WAN controllers, particularly vSmart and vBond roles, should treat any unpatched controller as potentially compromised and hunt for the runit and file artefacts in §5 before assuming a patch alone has closed the exposure.

2. Regulatory framing

3. Technical analysis & attack chain

Talos describes the activity as historical and does not state when the intrusions occurred. The confirmed chain, from Talos reporting, is:

1. The actor exploited CVE-2026-20127, an authentication bypass in Cisco Catalyst SD-WAN Controller instances, to bypass authentication and gain unauthorised access. Cisco fixed the flaw in February 2026 according to The Hacker News; Talos states patches have been released.
2. The actor modified runit service launchers under /etc/sv/sshd/ and /etc/sv/aaamgr/ to add malicious lines that remount /rootfs.rw executable and launch KeyDrift components alongside the legitimate service.
3. In the sshd deployment, a malicious script conf_sshd runs in the background, enumerates running vdaemon PIDs, records them in /tmp/system-vdaemon, and invokes the injector rsshd.
4. rsshd uses ptrace to inject PolyFlame (libdssl.so) into each vdaemon process.
5. PolyFlame interposes socket, DTLS and runtime-linker behaviour through recvfrom, sendto, getpeername, dlopen, dlsym, mprotect and /proc/%d/maps parsing, giving in-band control-plane access from inside the legitimate daemon.
6. LittleFilch hooks SSL_read inside vdaemon, inspects decrypted control-plane buffers, extracts keying material for a predefined list of edge nodes, RSA-encrypts it, writes it to /var/tmp/vdaemon.bin, and can send it over UDP in a DTLS 1.2 application-data style record.

PolyFlame has no hardcoded IPv4 addresses, binding ports, callback domains, URLs, host headers or polling interval in the samples Talos analysed. It is designed for in-band tasking over SD-WAN control-plane traffic. Its recvfrom hook calls the real recvfrom first to learn the C2 address, then checks a time gate: the C2 sends the MD5 of a date string, the implant computes the MD5 of its local time in %Y-%m-%d format, and stops if the values differ. On a match it processes an administrative code from the C2. PolyFlame also carries a backdoor matching TinyShell capabilities (file read, file write, arbitrary command execution, no interactive shell) with different command codes, and an intermediate C2 component that connects to one upstream C2 but can serve many peers.

The aaamgrd variant masquerades as the aaamgr service. The legitimate aaamgr is a Python package and does not normally appear as a compiled ELF runit service. The malicious aaamgrd is a statically linked ELF64 with no section headers, a single RWE loader segment and an RC4-encrypted embedded ELF payload. It uses direct syscalls including ptrace, fork, wait4, kill, tgkill, mmap and mprotect, and performs an anti-debug check by deobfuscating /proc/%d/status and TracerPid, exiting if a tracer is present. Talos also observed timestomping using touch --reference= and chmod --reference= to copy reference file metadata.

LittleFilch's SSL_read hook processes a buffer only when the returned size exceeds 0x18F, the first decrypted byte is 0x07, and three marker patterns are present. The markers and parsed fields are:

LittleFilch reads its configuration from /var/tmp/vdaemon.conf, which holds one local bind IP/port and one remote destination IP/port, and deletes the file after reading. Talos could not recover vdaemon.conf.

Talos maps the activity to MITRE ATT&CK techniques T1055.008 (Ptrace System Calls), T1574.006 (Dynamic Linker Hijacking), T1037, T1543, T1036.004, T1059.004, T1027.002, T1497.001, T1070.006, T1040 and T1573.001.

Attribution caveat: Talos assesses with high confidence that UAT-11473's operating infrastructure overlaps Volt Typhoon's "Silent Train" covert access network. UAT-11473 has no MITRE ATT&CK profile, and the overlap assessment is single-sourced to Talos. Treat the link to Volt Typhoon (G1017) as unconfirmed. Talos reports observed targeting across space and satellite services, defence and aerospace technology, and policy research; no EMEA financial services victim is named in the sources.

4. Mitigation & containment

P1 within 24h

• Patch CVE-2026-20127 on every Cisco Catalyst SD-WAN Controller. Cisco has released patches and a hardening guide for Catalyst SD-WAN deployments; apply both.
• Hunt every controller for the runit artefacts: modified launchers under /etc/sv/sshd/ and /etc/sv/aaamgr/, the presence of conf_sshd, rsshd, libdssl.so, aaamgrd, /tmp/system-vdaemon, /var/tmp/vdaemon.bin and /var/tmp/vdaemon.conf. Any hit means treat the controller as compromised.
• Check for a compiled ELF aaamgrd where the legitimate aaamgr Python package should be. The legitimate component is Python and does not appear as a compiled ELF runit service.
• Deploy the Snort SIDs Cisco published for CVE-2026-20127 (65938, 65958) and the SIDs for the malicious artefacts at the network perimeter facing the controllers.

P2 within 72h

• Review controller authentication logs for the period since the February 2026 fix for signs of authentication bypass against CVE-2026-20127.
• Check file metadata on runit service files and controller binaries for timestomping, since the actor used touch --reference= and chmod --reference= to copy reference metadata.
• If a controller is confirmed compromised, rotate the SD-WAN data-plane IPsec keys and any credentials or certificates held on the controller, because LittleFilch targets the OMP-distributed AES-256 IPsec key material.
• Restrict management access to controllers to a dedicated management network and named administrative hosts.

P3 within 7 days

• Apply the Cisco hardening guide across all Catalyst SD-WAN deployments, not only those with confirmed exposure.
• Add the §6 YARA and Sigma rules to controller host monitoring and central logging.
• Confirm that controller file-integrity monitoring covers /etc/sv/, /tmp/ and /var/tmp/.

5. Indicators of compromise

No network atomic indicators (IPs, domains, URLs) are available: Talos recovered none from the PolyFlame samples. The indicators below are file paths and filenames from the Talos report. All are single-sourced to Talos; verify before enforcement.

filepath  /etc/sv/sshd/run
filepath  /etc/sv/aaamgr/run
filename  conf_sshd
filename  rsshd
filename  libdssl.so
filename  aaamgrd
filepath  /tmp/system-vdaemon
filepath  /var/tmp/vdaemon.bin
filepath  /var/tmp/vdaemon.conf

Behavioural indicators

6. Detection

rule KeyDrift_PolyFlame_LittleFilch_Strings
{
    meta:
        author = "Adverse Trace"
        date = "2026-10-29"
        reference = "https://blog.talosintelligence.com/uat-11473-keydrift/"
        description = "Detects KeyDrift component artefacts (PolyFlame, LittleFilch, aaamgrd loader, runit launchers) by distinctive strings from the Talos report"
    strings:
        $s1 = "conf_sshd" ascii
        $s2 = "rsshd" ascii
        $s3 = "libdssl.so" ascii
        $s4 = "aaamgrd" ascii
        $s5 = "/tmp/system-vdaemon" ascii
        $s6 = "/var/tmp/vdaemon.bin" ascii
        $s7 = "/var/tmp/vdaemon.conf" ascii
        $s8 = "TracerPid" ascii
        $s9 = "/proc/%d/status" ascii
        $s10 = "/proc/%d/maps" ascii
        $s11 = "SSL_read" ascii
        $s12 = "recvfrom" ascii
        $s13 = "getpeername" ascii
        $s14 = "RTLD_NEXT" ascii
    condition:
        uint32(0) == 0x464c457f and 4 of them
}

title: KeyDrift runit service modification and vdaemon injection
id: 8f3c2a10-uat11473-keydrift
status: experimental
description: Detects modification of Cisco SD-WAN runit service launchers and execution of KeyDrift injector components
author: Adverse Trace
date: 2026-10-29
references:

    - https://blog.talosintelligence.com/uat-11473-keydrift/
logsource:
    product: linux
    category: process_creation
detection:
    selection_injector:
        Image|endswith:

            - '/rsshd'
            - '/conf_sshd'
            - '/aaamgrd'
    selection_runit:
        TargetFilename|startswith:

            - '/etc/sv/sshd/'
            - '/etc/sv/aaamgr/'
    selection_staging:
        TargetFilename:

            - '/tmp/system-vdaemon'
            - '/var/tmp/vdaemon.bin'
            - '/var/tmp/vdaemon.conf'
    condition: selection_injector or selection_runit or selection_staging
falsepositives:

    - Legitimate Cisco SD-WAN service updates; baseline before alerting
level: high

Threat actor context

Volt Typhoon · G1017 · aka BRONZE SILHOUETTE, Vanguard Panda, DEV-0391, UNC3236, Voltzite

Volt Typhoon is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021, primarily targeting critical infrastructure organizations in the US and its territories including Guam. …

No MITRE ATT&CK profile for: UAT-11473.

7. Sources

• Cisco Talos, "Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN", https://blog.talosintelligence.com/uat-11473-keydrift/, 2026-10-28.
• The Hacker News, "Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys", https://thehackernews.com/2026/10/hackers-exploited-cisco-sd-wan-flaw-to.html, October 2026.

8. Adverse Trace position

Adverse Trace assesses the technical severity as high for any EMEA financial services firm running unpatched Cisco Catalyst SD-WAN controllers, because KeyDrift gives an intruder in-band access to the control plane and the data-plane IPsec key material that protects site-to-site traffic. No CVSS score, severity rating, EPSS score or CISA KEV entry for CVE-2026-20127 is available in the reference data supplied to us, so we do not assign one; clients should take the rating from Cisco's own advisory. The link between UAT-11473 and Volt Typhoon (G1017) is a single-source Talos assessment and UAT-11473 has no MITRE ATT&CK profile, so we treat the attribution as unconfirmed. The targeting Talos reports (space and satellite, defence and aerospace, policy research) does not name a financial services victim, but the technique is product-specific and applies to any firm running the affected controllers. Adverse Trace will monitor for Cisco's CVE-2026-20127 advisory detail and any KEV listing, and will issue a follow-up if either appears. Clients should confirm patch status on every controller and run the §5 hunts before the end of the week.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.