# UAT-11473

Published articles for UAT-11473.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware

DevFeed: [Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware](<https://devfeed.tech/articles/hackers-exploit-cisco-sd-wan-flaw-to-deploy-custom-keydrift-malware-106710.md>)

Original publisher: [Read original article](<https://www.bleepingcomputer.com/news/security/hackers-exploit-cisco-sd-wan-flaw-to-deploy-custom-keydrift-malware/>)

Author: Bill Toulas

Published: 2026-10-29T18:38:26Z

Content type: news

Language: en

Sources: [BleepingComputer](<https://devfeed.tech/sources/bleepingcomputer.md>)

Topics: [Malware](<https://devfeed.tech/topics/malware.md>), [SD-WAN](<https://devfeed.tech/topics/sd-wan.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Cisco Talos](<https://devfeed.tech/topics/cisco-talos.md>), [Cisco](<https://devfeed.tech/topics/cisco.md>)

Tags: [2023](<https://devfeed.tech/tags/2023.md>), [2026](<https://devfeed.tech/tags/2026.md>), [advanced-persistent-threat](<https://devfeed.tech/tags/advanced-persistent-threat.md>), [aerospace](<https://devfeed.tech/tags/aerospace.md>), [apt](<https://devfeed.tech/tags/apt.md>), [authentication-bypass](<https://devfeed.tech/tags/authentication-bypass.md>), [catalyst-sd-wan](<https://devfeed.tech/tags/catalyst-sd-wan.md>), [cisco](<https://devfeed.tech/tags/cisco.md>), [cisco-sd-wan](<https://devfeed.tech/tags/cisco-sd-wan.md>), [computer-help](<https://devfeed.tech/tags/computer-help.md>), [computer-security](<https://devfeed.tech/tags/computer-security.md>), [computers](<https://devfeed.tech/tags/computers.md>), [controllers](<https://devfeed.tech/tags/controllers.md>), [custom](<https://devfeed.tech/tags/custom.md>), [cve](<https://devfeed.tech/tags/cve.md>), [deploy](<https://devfeed.tech/tags/deploy.md>), [exploit](<https://devfeed.tech/tags/exploit.md>), [framework](<https://devfeed.tech/tags/framework.md>), [hackers](<https://devfeed.tech/tags/hackers.md>), [infosec](<https://devfeed.tech/tags/infosec.md>), [infosec-computer-security](<https://devfeed.tech/tags/infosec-computer-security.md>), [keydrift](<https://devfeed.tech/tags/keydrift.md>), [linux](<https://devfeed.tech/tags/linux.md>), [mac](<https://devfeed.tech/tags/mac.md>), [malware](<https://devfeed.tech/tags/malware.md>), [malware-removal](<https://devfeed.tech/tags/malware-removal.md>), [sd-wan](<https://devfeed.tech/tags/sd-wan.md>), [security](<https://devfeed.tech/tags/security.md>), [spyware](<https://devfeed.tech/tags/spyware.md>), [support](<https://devfeed.tech/tags/support.md>), [tech-support](<https://devfeed.tech/tags/tech-support.md>), [technical-support](<https://devfeed.tech/tags/technical-support.md>), [uat-11473](<https://devfeed.tech/tags/uat-11473.md>), [virus](<https://devfeed.tech/tags/virus.md>), [virus-removal](<https://devfeed.tech/tags/virus-removal.md>), [windows](<https://devfeed.tech/tags/windows.md>)

### AI overview

UAT-11473 was observed exploiting Cisco Catalyst SD-WAN flaw CVE-2026-20127 to install KeyDrift, a framework Talos assesses is built for persistent access and automated collection of sensitive keying material. Its PolyFlame component runs in legitimate vdaemon processes and supports command execution, file transfer, and relaying communications. LittleFilch hooks SSL_read to inspect decrypted control traffic, extracts node identifiers and a field Talos assesses to be AES-256 IPsec key material, then encrypts and stages the data before UDP transmission. Observed targets included space and satellite services, defense and aerospace technology, and policy research organizations. Talos sees possible overlap between UAT-11473 and Volt Typhoon's "Silent Train" network but makes no definitive link. Cisco patched the max-severity flaw in February 2026 and recommends applying the security updates and consulting its Catalyst SD-WAN hardening guide.

### Source excerpt

A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift. [...]