Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN

Cisco Talos describes UAT-11473, an actor that exploited CVE-2026-20127, an authentication bypass in Cisco SD-WAN Catalyst Controller, to install a malware framework called KeyDrift. Its PolyFlame module runs inside vdaemon processes, while LittleFilch hooks SSL_read to extract assessed IPsec data-plane keys from decrypted control traffic. Talos reports high-confidence infrastructure overlap with Volt Typhoon and targeting of space, defense and policy organizations; the report cites no independent sources for these points. Cisco has released patches and a hardening guide.