Cisco Talos ties new APT to KeyDrift malware on exploited SD-WAN controllers

Cisco Talos researchers have described a newly identified advanced persistent threat group, tracked as UAT-11473, exploiting an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers to deploy a custom malware framework called KeyDrift. BleepingComputer reported the findings on October 29, 2026.

The flaw, CVE-2026-20127, is a max-severity bug that Cisco patched in February 2026. It lets remote attackers gain privileged access to Catalyst SD-WAN Controller and Manager and add rogue peers. Talos says the group targeted space and satellite services, defense and aerospace technology, and policy research organizations.

Talos assesses with high confidence that KeyDrift is built for long-term persistent access and automated exfiltration of sensitive keying material. It runs inside SD-WAN control-plane processes, intercepts decrypted control traffic, and stages or transmits what it collects in encrypted records. Its two components, PolyFlame and LittleFilch, showed signs of ongoing development, including new anti-debugging mechanisms and varied process impersonation.

Talos said UAT-11473 appears to overlap with Volt Typhoon's "Silent Train" covert access network but made no definitive links. The report also notes that a separate group, UAT-8616, exploited the same flaw as a zero-day since at least 2023.

Cisco recommends administrators apply the available updates and follow its hardening guide for Catalyst SD-WAN deployments.

CVE references

CVE-2026-20127