Loading malware…
LittleFilch is a key-material collection component of the KeyDrift malware framework used by UAT-11473 against Cisco Catalyst SD-WAN environments. It operates inside the legitimate vdaemon process on compromised SD-WAN Controllers, formerly known as vSmart, and hooks SSL_read to inspect control-plane messages after decryption. It filters messages for predefined edge nodes and extracts edge-router addressing information and 32-byte keying fields.
LittleFilch encrypts collected records with RSA and stages them locally. It can transmit the encrypted records over UDP using a DTLS 1.2 application-data-style format. Local configuration supplies bind and destination addressing information and is deleted after being read. Successful transmission of collected material has not been confirmed.
UAT-11473 deployed KeyDrift after exploiting CVE-2026-20127, an authentication-bypass vulnerability in Cisco Catalyst SD-WAN control components. Observed targeting included space and satellite services, defense and aerospace technology, and policy research organizations. LittleFilch provides the framework's specialized collection functionality, distinct from the command-execution and communication-relay capabilities of its PolyFlame component.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
On a compromised Controller, a KeyDrift component called LittleFilch hooks into vdaemon and reads control messages after they are decrypted.
3 distinct techniques documented for this family, organized by ATT&CK tactic.
PolyFlame uses dlsym(RTLD_NEXT, ...), dlopen, and runtime interposition
PolyFlame uses dlsym(RTLD_NEXT, ...), dlopen, and runtime interposition
PolyFlame and LittleFilch intercept SD-WAN control-plane traffic
PolyFlame and LittleFilch intercept SD-WAN control-plane traffic
PolyFlame AES implementation; aaamgrd RC4 packer; LittleFilch RSA-encrypted records
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.