UAT-11473 “KeyDrift” on Cisco Catalyst SD-WAN, linked to Volt Typhoon’s “Silent Train” network

What happened

• Cisco Talos describes UAT-11473 exploiting CVE-2026-20127 (SD-WAN controller peering auth bypass, Feb 2026) and implanting KeyDrift on controllers to steal keying material. Targets: space and satellite, defense and aerospace, policy research.
• Technique: PolyFlame, memory-resident in vdaemon, intercepts socket/DTLS traffic, gives a TinyShell-style backdoor and relays C2; LittleFilch hooks SSL_read in vdaemon and writes RSA-encrypted keys to /var/tmp/vdaemon.bin; trojanized runit launchers for persistence.
• Attribution: Talos names UAT-11473 and assesses with high confidence its infrastructure “overlaps considerably” with Silent Train, which Lumen ties to Volt Typhoon (China). Talos does not say they are the same actor. Lumen says Silent Train monitoring also exposed zero-day campaigns against Versa Director, N-able N-central, Cisco SD-WAN and VeloCloud Orchestrator (per SecurityWeek).
• Response: patch CVE-2026-20127, follow Cisco’s hardening guide, hunt for the listed artifacts; Snort coverage published.

Sources

• https://blog.talosintelligence.com/uat-11473-keydrift/
• https://www.securityweek.com/cisco-sd-wan-zero-day-exploitation-tied-to-volt-typhoons-silent-train-network/

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.