Attack Details and Malware
Cisco Talos research has uncovered activity by an advanced persistent threat (APT) group known as UAT-11473, which is exploiting a critical vulnerability designated as CVE-2026-20127 in Cisco Catalyst SD-WAN controllers. This vulnerability, rated at the highest severity level, allows attackers to bypass authentication and gain privileged access, enabling them to add unauthorized devices to the network.
The attackers use a custom software framework called KeyDrift, which is specifically designed to operate within SD-WAN controller environments. This framework consists of two main components: PolyFlame, responsible for command execution and communication control, and LittleFilch, which intercepts encrypted data traffic and extracts sensitive encryption keys (such as AES-256 IPsec keys).
Why This News Matters
The severity of this attack lies in the nature of its targets, which include sensitive sectors such as space and satellite services, defense and aerospace technologies, and political research institutions. KeyDrift's ability to operate within SD-WAN control operations grants attackers long-term and persistent access, along with the ability to automatically and securely extract sensitive data, making breach detection extremely difficult.
Estimates indicate potential overlap between the UAT-11473 group and the covert access network known as "Silent Train" associated with the Volt Typhoon group, heightening concerns regarding ongoing attacks targeting global network infrastructure.
What Administrators Should Do
Cisco has issued clear warnings to system administrators to take immediate action to protect their networks:
- Urgently apply available security updates for the CVE-2026-20127 vulnerability.
- Review and follow the Catalyst SD-WAN hardening guide provided by the company.
- Monitor unusual activities within controllers, especially those related to system files or code injection processes.
This incident underscores the importance of regularly updating network infrastructure, as reliance on valid access credentials after an initial compromise remains a major challenge for traditional defense tools.