KeyDrift Malware: How APT Group UAT-11473 Hijacked Cisco SD-WAN to Steal Encryption Keys
Executive Summary
In late 2026, Cisco Talos researchers identified a newly tracked APT cluster, UAT-11473, actively exploiting CVE-2026-20127—a maximum-severity authentication-bypass vulnerability in Cisco Catalyst SD-WAN Controllers—to deploy a custom malware framework called KeyDrift. The attackers, assessed to overlap with Volt Typhoon's Silent Train covert access network, targeted space and satellite services, defense and aerospace technology, and policy research organizations. KeyDrift's two components, PolyFlame and LittleFilch, enabled persistent access, control-plane traffic interception, AES-256 IPsec key material extraction, and encrypted exfiltration of stolen cryptographic keying data via UDP to attacker-controlled infrastructure.
This incident underscores a rising trend of nation-state APT actors targeting network control-plane infrastructure rather than endpoints, using custom implants specifically engineered to evade detection and harvest cryptographic keying material. As SD-WAN adoption accelerates across critical sectors, attacks that compromise the encryption fabric itself represent a qualitative escalation in persistent threat sophistication.
Why This Matters Now
CVE-2026-20127 was exploited as a zero-day for years before patching, and UAT-11473's KeyDrift framework demonstrates that nation-state actors are now targeting the cryptographic control plane of SD-WAN infrastructure—not just endpoints. With SD-WAN widely deployed across defense, aerospace, and critical infrastructure, the theft of IPsec key material can silently decrypt otherwise-protected traffic at scale, making patch urgency and network segmentation enforcement immediately critical.
Attack Path Analysis
UAT-11473 exploited CVE-2026-20127, a max-severity authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to gain privileged access without valid credentials and inject the KeyDrift malware framework into control-plane processes. From there, the threat actor escalated to process-level control, moved laterally across SD-WAN controller instances via rogue peer injection, established encrypted C2 channels through TinyShell-styled components, and exfiltrated AES-256 IPsec data-plane keying material and control-session metadata over encrypted UDP, ultimately enabling long-term covert access and cryptographic key compromise across targeted space, defense, and policy research organizations.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
UAT-11473 exploited CVE-2026-20127, an authentication-bypass vulnerability in Cisco Catalyst SD-WAN Controllers, to gain unauthorized privileged access remotely without requiring valid credentials. This allowed the attacker to interact with the SD-WAN Controller and Manager as an authenticated peer, establishing the initial foothold.
Related CVEs
CVE-2023-20198
CVSS 10A privilege escalation vulnerability in the web UI feature of Cisco IOS XE Software allows an unauthenticated remote attacker to create an account with privilege level 15 access, effectively granting full administrative control over the device.
Affected Products:
Cisco IOS XE Software (Web UI Feature) – < 17.9.4a, < 17.6.6a, < 17.3.8a, < 16.12.10a
Exploit Status:
exploited in the wildReferences:
https://nvd.nist.gov/vuln/detail/CVE-2023-20198https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4zhttps://www.cisa.gov/known-exploited-vulnerabilities-cataloghttps://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/CVE-2023-20273
CVSS 7.2A command injection vulnerability in the web UI feature of Cisco IOS XE Software allows an authenticated attacker with privilege level 15 to inject commands that are executed with root privileges on the underlying operating system.
Affected Products:
Cisco IOS XE Software (Web UI Feature) – < 17.9.4a, < 17.6.6a, < 17.3.8a, < 16.12.10a
Exploit Status:
exploited in the wildReferences:
https://nvd.nist.gov/vuln/detail/CVE-2023-20273https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4zhttps://www.cisa.gov/known-exploited-vulnerabilities-cataloghttps://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Valid Accounts
Create or Modify System Process: Windows Service
Process Injection
Network Sniffing
Unsecured Credentials: Private Keys
Exfiltration Over C2 Channel
Obfuscated Files or Information
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev 5 – Flaw Remediation and Vulnerability Monitoring
Control ID: SI-2 / RA-5
CISA Zero Trust Maturity Model 2.0 – Network Segmentation and Encrypted Traffic Inspection
Control ID: Network Pillar – Macro/Micro Segmentation
NIS2 Directive – Supply Chain and Network Infrastructure Security Measures
Control ID: Article 21 – Security of Network and Information Systems
DORA (EU) 2022/2554 – ICT Risk Management and Threat Intelligence Integration
Control ID: Article 9 – ICT Security Policies / Article 13 – ICT Threat Intelligence
PCI DSS 4.0 – Vulnerability Management and Security Event Monitoring
Control ID: Requirement 6.3 / Requirement 10.7
NYDFS 23 NYCRR 500 – Privileged Access Controls and Incident Response Planning
Control ID: Section 500.7 – Access Privileges / Section 500.16 – Incident Response
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Defense/Space
UAT-11473's KeyDrift APT directly targeted defense and aerospace organizations, extracting AES-256 IPsec keying material via Cisco SD-WAN exploitation, enabling persistent covert access to classified control-plane communications.
Government Administration
Policy research organizations and government networks using Cisco Catalyst SD-WAN face critical risk from CVE-2026-20127 authentication bypass, enabling rogue peer injection and long-term exfiltration of sensitive cryptographic session data.
Telecommunications
Cisco SD-WAN controller compromise via KeyDrift's LittleFilch module intercepts decrypted control-plane traffic and IPsec key material, critically undermining encrypted transit security across telecommunications backbone infrastructure.
Information Technology/IT
IT organizations managing hybrid SD-WAN deployments face systemic risk as KeyDrift's PolyFlame implant persists inside vdaemon processes, evading detection while exfiltrating cryptographic keys and enabling lateral movement across connected networks.
Sources
- Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malwarehttps://www.bleepingcomputer.com/news/security/hackers-exploit-cisco-sd-wan-flaw-to-deploy-custom-keydrift-malware/Verified
- Cisco Security Advisory: Cisco IOS XE Software Web UI Privilege Escalation Vulnerability (CVE-2023-20198)https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4zVerified
- NVD Detail: CVE-2023-20198https://nvd.nist.gov/vuln/detail/CVE-2023-20198Verified
- NVD Detail: CVE-2023-20273https://nvd.nist.gov/vuln/detail/CVE-2023-20273Verified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- Cisco Talos: Active Exploitation of Cisco IOS XE Softwarehttps://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/Verified
- CISA Advisory AA24-038A: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (Volt Typhoon)https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038aVerified
- Cisco Talos Intelligence: UAT-11473 KeyDrift Campaign Analysishttps://blog.talosintelligence.com/uat-11473-keydrift/
- Lumen Technologies: Volt Typhoon Silent Train Framework Researchhttps://blog.lumen.com/volt-typhoon-silent-train/
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant because UAT-11473 exploited unauthenticated access to SD-WAN control-plane infrastructure and then moved freely across controller instances, exfiltrating cryptographic keying material. A segmented, identity-aware network fabric would likely constrain the attacker's reachability to controller management surfaces and reduce the blast radius of lateral movement across the SD-WAN fabric.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Segmented access policies within the CNSF fabric would likely reduce the attacker's ability to reach SD-WAN controller management interfaces from untrusted external origins, constraining the initial reachability that made the authentication-bypass exploitable at scale.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely constrain the privilege scope available to newly registered peers, reducing the attacker's ability to propagate PolyFlame injections across controller processes beyond the initially compromised workload boundary.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement would likely reduce the attacker's ability to relay peer-to-peer communications freely across controller instances, constraining lateral traversal paths through the SD-WAN fabric to only explicitly permitted workload-to-workload flows.
Control: Multicloud Visibility & Control
Mitigation: Centralized multicloud visibility would likely surface anomalous encrypted outbound sessions originating from SD-WAN controller workloads, reducing the attacker's ability to sustain covert C2 communications without those flows appearing as policy deviations in traffic telemetry.
Control: Egress Security & Policy Enforcement
Mitigation: Egress policy enforcement would likely constrain outbound UDP traffic from SD-WAN controller workloads to unrecognized external destinations, reducing the attacker's ability to complete transmission of staged cryptographic keying material to attacker-controlled infrastructure.
Had earlier segmentation and egress controls constrained lateral movement and keying material exfiltration, the attacker's ability to decrypt IPsec-protected traffic at scale would likely have been reduced to a narrower set of compromised nodes rather than spanning the broader SD-WAN fabric.
Impact at a Glance
Affected Business Functions
- Satellite and Space Communications Network Operations
- Defense Aerospace Secure Command and Control Infrastructure
- SD-WAN Control-Plane Key Management and Cryptographic Operations
- Policy and Intelligence Research Data Repositories
Estimated downtime: N/A
Estimated loss: N/A
The KeyDrift malware framework specifically targeted and exfiltrated AES-256 IPsec data-plane keying material and control-session metadata from Cisco SD-WAN controllers. Compromised cryptographic keys would allow adversaries to decrypt previously captured or future SD-WAN traffic traversing defense, aerospace, satellite, and policy research networks. Extracted keying material includes 32-byte AES-256 keys stored in /var/tmp/vdaemon.bin and transmitted via RSA-encrypted UDP exfiltration. Victim organizations in space and satellite services, defense and aerospace technology, and policy research face exposure of encrypted network communications, network topology intelligence, peer endpoint IP identifiers, and sensitive inter-site traffic. Long-term persistent access implies potential exfiltration of classified or sensitive programmatic data, mission telemetry, and strategic research over an extended dwell period estimated to span years given zero-day exploitation since at least 2023.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Inline IPS (Suricata) with signatures targeting CVE-2026-20127 exploit traffic and KeyDrift payload patterns at ingress points to the SD-WAN controller management plane, blocking exploit attempts before initial access is established.
- • Enforce Zero Trust Segmentation with identity-based microsegmentation policies to restrict which workloads and identities can initiate control-plane sessions with SD-WAN controllers, preventing rogue peer injection and limiting privilege escalation blast radius.
- • Enable East-West Traffic Security controls to inspect and baseline workload-to-workload and peer-to-peer SD-WAN fabric communications, detecting anomalous lateral relay activity introduced by PolyFlame's multi-peer C2 propagation.
- • Activate Multicloud Visibility & Control with centralized traffic observability and anomaly baselining across SD-WAN control-plane flows to identify suspicious encrypted UDP exfiltration patterns consistent with LittleFilch's keying material staging and transmission behavior.
- • Apply Egress Security & Policy Enforcement with FQDN filtering and outbound traffic controls to block unauthorized UDP egress to attacker-controlled destinations, directly disrupting the exfiltration of RSA-encrypted AES-256 IPsec key material to external infrastructure.
