talos · Crawled Nov 1, 2026

Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN

9 IoCs 1 Actors
Read original article ↗

AI Summary

Cisco Talos identified UAT-11473, a sophisticated APT group, exploiting CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller, to gain unauthorized access. The actor deployed a custom malware framework named 'KeyDrift', which includes components like PolyFlame and LittleFilch, designed to intercept decrypted control traffic, extract data-plane keying material, and establish backdoors. Targeted sectors include space and satellite services, defense, aerospace, and policy research. Talos assesses with high confidence that UAT-11473's infrastructure overlaps with Volt Typhoon’s 'Silent Train' network.

AI-extracted · verify before operational use

Extracted Entities 1 found

Threat Actor Volt Typhoon →

Indicators of Compromise 9 extracted

Type Value Detail
Filename conf_sshd Details →
Filename /tmp/system-vdaemon Details →
Filename rsshd Details →
Filename libdssl.so Details →
Filename aaamgrd Details →
Filename /etc/sv/aaamgr/ Details →
Filename libcommon.so Details →
Filename /var/tmp/vdaemon.bin Details →
Filename /var/tmp/vdaemon.conf Details →

MITRE ATT&CK TTPs 16 techniques

T1027.002 Software Packing · Defense Evasion T1036.004 Masquerade Task or Service · Defense Evasion T1037 Boot or Logon Initialization Scripts · Persistence T1040 Network Sniffing · Credential Access T1055.008 Ptrace System Calls · Defense Evasion T1059.001 PowerShell · Execution T1059.004 Unix Shell · Execution T1070.006 Timestomp · Defense Evasion T1078 Valid Accounts · Defense Evasion T1190 Exploit Public-Facing Application · Initial Access T1210 Exploitation of Remote Services · Lateral Movement T1497.001 System Checks · Defense Evasion T1499 Endpoint Denial of Service · Impact T1543 Create or Modify System Process · Persistence T1573.001 Symmetric Cryptography · Command And Control T1574.006 Dynamic Linker Hijacking · Persistence