Cisco Talos has published a detailed teardown of KeyDrift, a bespoke implant framework that a state-grade actor planted inside Cisco Catalyst SD-WAN controllers to harvest the keys protecting branch traffic. The infrastructure behind it overlaps heavily with Volt Typhoon’s covert network, and any UK organisation that patched CVE-2026-20127 without hunting for compromise should take a second look.
What happened
On 28 October 2026 Cisco Talos described a threat cluster it tracks as UAT-11473, which it rates as a highly sophisticated advanced persistent threat. The group got into Cisco Catalyst SD-WAN Controller instances through CVE-2026-20127, the peering authentication bypass that Cisco, the NCSC and Five Eyes partners warned about in February. After getting in, the operators installed a modular toolkit that Talos has named KeyDrift.
The targeting Talos observed spans three sectors: space and satellite services, defence and aerospace technology, and policy research. Talos has not named victim countries. The headline call is attribution by infrastructure: Talos has high confidence that the group’s servers overlap considerably with “Silent Train”, the covert access network tied to China-linked Volt Typhoon. That is a finding about shared infrastructure, not proof of a single actor, since covert relay networks can serve several state-aligned teams.
Talos describes this as historical activity and gives no intrusion dates. Talos tracks it under a different label from UAT-8616, the cluster behind the exploitation disclosed in February, which Talos traced back to 2023.
The technical picture
Persistence comes from the runit service supervisor that the controllers use. The operators changed the launch scripts for the sshd and aaamgr services. The altered sshd script remounts the /rootfs.rw overlay as executable and quietly launches a helper, conf_sshd, before the real SSH daemon comes up as normal. The helper finds every vdaemon process (which handles DTLS control sessions with edge routers) and has a ptrace injector, rsshd, load the main implant into each.
That main implant is PolyFlame, delivered as libdssl.so. Inside vdaemon it hooks socket, DTLS and linker functions such as recvfrom and dlsym, giving it sight of session keys, edge topology, OMP routes and policy tables. Talos found no hardcoded IPs, ports or domains: tasking rides in-band on control-plane traffic and must carry an MD5 hash of the current date. PolyFlame then acts either as a TinyShell-like backdoor (commands, file read and write) or as a one-to-many relay that turns the controller into a hop point inside the fabric.
On a vBond appliance Talos found a second delivery route: a packed, statically linked ELF named aaamgrd posing as the aaamgr service. The genuine Cisco aaamgr is a Python package, so a compiled binary with that name should not exist. It decrypts an RC4-protected payload, exits if a debugger is attached, and tampers with PAM configuration. Files were timestomped to match legitimate ones.
The component that justifies the name is LittleFilch (libcommon.so), seen in vSmart processes. It hooks OpenSSL’s SSL_read, waits for decrypted control messages that match specific byte patterns, and pulls out edge router public IPs, OMP system-IPs and 32-byte values that Talos assesses to be AES-256 IPsec data-plane keys. The haul is RSA-encrypted into /var/tmp/vdaemon.bin and can leave over UDP disguised as DTLS 1.2 records, to an endpoint taken from a config file the module deletes once read. Multiple module variants suggest active development.
Why it matters for UK organisations
SD-WAN is now the default way UK retailers, councils, NHS suppliers and professional services firms link branches, often through a managed service provider. A controller holds routing and encryption policy for the entire WAN, so owning one is worth far more than owning a router.
The key theft is what changes the risk. An adversary holding data-plane IPsec keys who can also capture traffic in transit can no longer be assumed locked out of inter-site traffic. The sectors Talos lists, aerospace, defence, space and policy research, map closely onto the UK’s defence supply chain, think tanks and university research groups.
The UK context is already documented. On 25 February 2026 the NCSC joined ASD’s ACSC, CISA, the NSA and the Canadian and New Zealand agencies in a joint hunt guide on Catalyst SD-WAN exploitation. The guide told organisations to look for compromise, report it to the NCSC, update and apply Cisco’s hardening guide. It also said management interfaces should never face the internet. The KeyDrift report shows what a thorough attacker may have left behind on a controller that was later patched.
Expert view
This is the edge-device problem pushed a layer deeper. Firewalls and VPN concentrators are accepted prime targets because they are exposed, lack EDR and are hard to inspect. SD-WAN controllers share every weakness and also hold the keys. In my experience controllers barely appear in vulnerability scans and almost never in a red team scope, because they are seen as plumbing that belongs to the network team or the MSP.
The tradecraft is disciplined. There is no fixed beacon, tasking travels inside protocol traffic the box is meant to carry, the implant runs only in memory inside a trusted daemon, and the staging files are timestomped. Outbound connection reviews and casual file-system checks will find nothing. The weak spots are the runit scripts and files that should not exist, so start there.
A patch fixes the way in, but it does nothing about what is already running. If your controllers were exposed when CVE-2026-20127 was a zero-day, treat a clean patch record as proof of nothing. When we test segmented networks, the overlay that everyone trusts is often where an attacker can move most freely.
What to do now
- Confirm patch status on every Catalyst SD-WAN Controller (vSmart), Validator (vBond) and Manager against Cisco’s advisory for CVE-2026-20127, including cloud-hosted controllers your MSP runs on your behalf. This is the Cyber Essentials security update management control.
- Hunt, even if you are patched. Check the sshd and aaamgr runit run scripts under /rootfs.rw/etc/sv/ for remount commands or references to conf_sshd or aaamgrd. Look for /tmp/system-vdaemon, /var/tmp/vdaemon.bin, libdssl.so or libcommon.so where they do not belong, and for any compiled aaamgrd binary.
- Use the published detections. Talos lists Snort rules 65938 and 65958 for the vulnerability, and 67387 to 67416 (Snort 2) and 7:44 to 7:73 (Snort 3) for KeyDrift artefacts.
- If you find anything, treat the keys as compromised. Collect artefacts before rebuilding, report to the NCSC, open a Cisco TAC case, rebuild controllers from known-good images and rotate certificates and data-plane keys across the fabric.
- Take management off the internet. Put control components behind a firewall, restrict peering to known edge IPs and send controller logs to a remote syslog server, in line with the hunt guide and Cisco’s hardening guide. This maps to the Cyber Essentials firewall and secure configuration controls.
- Bring SD-WAN into scope. Ask your MSP for evidence of compromise assessment, and include controllers in pentests and threat-hunting plans.
Bottom line
KeyDrift shows a Volt Typhoon-adjacent operator treating SD-WAN controllers as a long-term listening post and key store, not a one-off foothold. Patching CVE-2026-20127 closed the door, but only a proper hunt shows whether anyone is still inside. UK organisations running Catalyst SD-WAN, especially in defence, aerospace and research supply chains, should run that hunt now.
Sources
- Cisco Talos: Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
- NCSC: Exploitation of Cisco Catalyst SD-WAN
- SecurityOnline: UAT-11473 Deploys KeyDrift Malware on Cisco SD-WAN Controllers via CVE-2026-20127
- Mallory: UAT-11473 Exploits Cisco SD-WAN Authentication Bypass to Deploy KeyDrift Malware
- Computer Weekly: Cisco Catalyst SD-WAN users targeted in series of cyber attacks
