UAT-11473

UAT-11473 is an advanced persistent threat actor tracked by Cisco Talos that targets space and satellite services, defense and aerospace technology, and policy research organizations. It has exploited CVE-2026-20127, an authentication-bypass vulnerability in Cisco Catalyst SD-WAN Controllers, to gain unauthorized access and deploy the custom KeyDrift malware framework. Its country of origin and state affiliation have not been established. Its operating infrastructure substantially overlaps with Silent Train, a compromised-device network used by Volt Typhoon, but this overlap does not establish that the actors are identical. KeyDrift provides persistent access within legitimate SD-WAN control-plane processes. Its PolyFlame component is a memory-resident backdoor injected using ptrace that supports arbitrary command execution, file reading and writing, and command-and-control relaying between an upstream server and peers. It supports in-band tasking through SD-WAN control traffic. Persistence mechanisms include modified service initialization scripts and malicious services masquerading as legitimate components. Defense-evasion techniques include process injection, dynamic linker hijacking, software packing, anti-debugging checks, and timestomping. KeyDrift's LittleFilch component hooks decrypted control-plane traffic and extracts selected edge-router metadata and fields assessed to contain AES-256 IPsec data-plane encryption keys. It encrypts collected records with RSA and stages them locally, with functionality to transmit them over UDP using records resembling DTLS application data. Actual transmission of the collected key material has not been confirmed.