Talos says the actor exploited the February SD-WAN authentication bypass (CVE-2026-20127, CVSS 10.0), then installed a framework built to live inside the controller's own vdaemon process. Targets were in space and satellite services, defense and aerospace technology, and policy research. Talos assesses with high confidence that the actor's infrastructure overlaps heavily with the Silent Train relay network that Lumen ties to Volt Typhoon.

• PolyFlame (libdssl.so): injected into vdaemon by an injector called rsshd, launched from a trojanized runit script under /etc/sv/sshd/ that remounts /rootfs.rw executable and runs conf_sshd (which writes PIDs to /tmp/system-vdaemon). It acts as a TinyShell-style backdoor or a relay to other peers. A packed variant runs as aaamgrd under /etc/sv/aaamgr/; the real aaamgr is Python, not an ELF.
• LittleFilch (libcommon.so): hooks SSL_read in vdaemon, pulls edge-router IPs and a 32-byte field Talos assesses as AES-256 data-plane key material, RSA-encrypts it into /var/tmp/vdaemon.bin and can send it over UDP to an endpoint read from /var/tmp/vdaemon.conf, which it then deletes.
• Coverage: Snort 2 SIDs 67387 to 67416 and Snort 3 7:44 to 7:73 for the implants; 65938 and 65958 for the CVE.

Hunt: look for the files and runit changes above, timestomped files under service paths, and, per Cisco's advisory, Accepted publickey for vmanage-admin lines in /var/log/auth.log from IPs that are not your configured System IPs, plus control peering events at odd times or from unknown addresses. If you find any, treat the fabric's IPsec keys as exposed and open a TAC case.