---
title: Hunt: Talos details KeyDrift, malware that UAT-11473 put on Cisco Catalyst SD-WAN controllers through CVE-2026-20127 to copy the AES keys that encrypt traffic between sites | ctxsec
url: https://ctxsec.com/items/hunt-talos-keydrift-uat-11473-sdwan-controller-key-theft
description: ""
status: "official vendor research (Cisco Talos, Oct 28); Talos calls the activity historical and does not say when it happened"
published: 2026-10-29
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-talos-keydrift-uat-11473-sdwan-controller-key-theft.md)

official vendor research (Cisco Talos, Oct 28); Talos calls the activity historical and does not say when it happened

2026-10-29

### Hunt: Talos details KeyDrift, malware that UAT-11473 put on Cisco Catalyst SD-WAN controllers through CVE-2026-20127 to copy the AES keys that encrypt traffic between sites

Talos says the actor exploited the February SD-WAN authentication bypass (CVE-2026-20127, CVSS 10.0), then installed a framework built to live inside the controller's own `vdaemon` process. Targets were in space and satellite services, defense and aerospace technology, and policy research. Talos assesses with high confidence that the actor's infrastructure overlaps heavily with the Silent Train relay network that Lumen ties to Volt Typhoon.

- **PolyFlame** (`libdssl.so`): injected into `vdaemon` by an injector called `rsshd`, launched from a trojanized runit script under `/etc/sv/sshd/` that remounts `/rootfs.rw` executable and runs `conf_sshd` (which writes PIDs to `/tmp/system-vdaemon`). It acts as a TinyShell-style backdoor or a relay to other peers. A packed variant runs as `aaamgrd` under `/etc/sv/aaamgr/`; the real aaamgr is Python, not an ELF.
- **LittleFilch** (`libcommon.so`): hooks `SSL_read` in `vdaemon`, pulls edge-router IPs and a 32-byte field Talos assesses as AES-256 data-plane key material, RSA-encrypts it into `/var/tmp/vdaemon.bin` and can send it over UDP to an endpoint read from `/var/tmp/vdaemon.conf`, which it then deletes.
- **Coverage:** Snort 2 SIDs 67387 to 67416 and Snort 3 7:44 to 7:73 for the implants; 65938 and 65958 for the CVE.

**Hunt:** look for the files and runit changes above, timestomped files under service paths, and, per Cisco's advisory, `Accepted publickey for vmanage-admin` lines in `/var/log/auth.log` from IPs that are not your configured System IPs, plus control peering events at odd times or from unknown addresses. If you find any, treat the fabric's IPsec keys as exposed and open a TAC case.

Sources: [Cisco Talos: Inside KeyDrift, analyzing historical UAT-11473 activity on Cisco SD-WAN (Oct 28)](https://blog.talosintelligence.com/uat-11473-keydrift/) · [Cisco advisory cisco-sa-sdwan-rpa-EHchtZk (CVE-2026-20127), with indicators of compromise and peering validation guidance](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk)