Actor Profile

UAT-11473 is a newly identified advanced persistent threat group that exploited CVE-2026-20127, a maximum-severity authentication-bypass vulnerability in Cisco Catalyst SD-WAN Controllers. Cisco Talos researchers assess that UAT-11473 appears to overlap with Volt Typhoon's "Silent Train" covert access network, though no definitive attribution has been established. Volt Typhoon is a Chinese state-sponsored hacking group known for conducting zero-day vulnerability attacks while evading detection. The group's motivation appears to be long-term persistent access to critical infrastructure and exfiltration of sensitive cryptographic material from SD-WAN environments. The deployment of the custom KeyDrift malware framework suggests sophisticated capabilities and operational maturity focused on maintaining covert access to network control infrastructure.

TTPs (Tactics, Techniques, Procedures)

UAT-11473 exploited CVE-2026-20127, an authentication-bypass vulnerability in Cisco Catalyst SD-WAN Controllers, to gain privileged access and add rogue peers. The group deployed KeyDrift, a custom malware framework with two primary components: PolyFlame and LittleFilch. PolyFlame operates inside legitimate vdaemon processes using modified service startup scripts and an injector, supporting command execution via TinyShell-styled components, file uploads/downloads, and C2 relay communications. LittleFilch hooks SSL_read to intercept decrypted control-plane messages, extracts IP identifiers and AES-256 IPsec data-plane key material for predefined edge nodes, uses RSA encryption to protect collected data, stages it to /var/tmp/vdaemon.bin, and exfiltrates via UDP. The framework demonstrates ongoing development with new anti-debugging mechanisms and varied process impersonation techniques. Key techniques include initial access via vulnerability exploitation, persistence through process injection and service modification, credential access through cryptographic key extraction, and command-and-control via encrypted channels.

Targets & Patterns

UAT-11473 targeted space and satellite services, defense and aerospace technology, and policy research organizations. This targeting pattern aligns with strategic intelligence collection objectives typical of state-sponsored actors. The focus on SD-WAN controllers in these sectors suggests the group seeks to compromise critical network infrastructure that manages secure communications and data flows. By targeting SD-WAN control-plane infrastructure, the actor gains visibility into network topology, routing decisions, and cryptographic keying material that protects data-plane traffic. The selection of space, defense, and policy research sectors indicates interest in national security-related intelligence, advanced technology development, and strategic policy formulation. This targeting is consistent with the assessed overlap with Volt Typhoon, which has historically focused on critical infrastructure for pre-positioning and intelligence gathering.

Historical Context

CVE-2026-20127 was patched by Cisco in February 2026, but a related threat cluster, UAT-8616, exploited the vulnerability as a zero-day since at least 2023. Recent research linked the exploitation of this vulnerability to the Chinese state-sponsored Volt Typhoon group. Cisco Talos assesses that UAT-11473 appears to overlap with Volt Typhoon's "Silent Train" covert access network, which was detailed in a Lumen report released in October 2026. The Silent Train framework allowed Volt Typhoon to evade detection while conducting zero-day vulnerability attacks. The observed KeyDrift malware shows signs of ongoing development, including new anti-debugging mechanisms and varied process impersonation, suggesting an evolving toolset. The multi-year exploitation timeline (2023-2026) and the connection to Volt Typhoon's infrastructure indicate this is part of a sustained, sophisticated campaign targeting critical infrastructure with advanced persistent access capabilities.

Defensive Recommendations

  • Immediately apply Cisco security updates for CVE-2026-20127 on all Cisco Catalyst SD-WAN Controllers and Managers to remediate the authentication-bypass vulnerability
  • Implement Cisco's dedicated hardening guide for Catalyst SD-WAN deployments to reduce attack surface and strengthen security posture
  • Monitor for suspicious modifications to vdaemon service startup scripts and unexpected process injection activity targeting legitimate SD-WAN control-plane processes
  • Establish file integrity monitoring for /var/tmp/vdaemon.bin and other temporary directories to detect staging of exfiltrated cryptographic material
  • Inspect network traffic for anomalous UDP communications from SD-WAN controllers, particularly encrypted data transmissions to unexpected external destinations
  • Deploy SSL/TLS inspection and hook detection capabilities to identify unauthorized interception of decrypted control-plane traffic via SSL_read hooks
  • Conduct forensic analysis of SD-WAN controller logs to identify unauthorized peer additions and privileged access attempts that may indicate historical compromise
  • Implement behavioral analytics to detect TinyShell-styled command execution patterns and unusual file upload/download activity from control-plane processes