Loading malware…
KeyDrift is a modular backdoor and key-collection framework deployed by UAT-11473 against Cisco Catalyst SD-WAN control infrastructure. The actor exploited the authentication-bypass vulnerability CVE-2026-20127 to gain access and install the framework. Observed targeting includes space and satellite services, defense and aerospace technology, and policy research organizations.
KeyDrift embeds within legitimate SD-WAN control-plane processes. Its PolyFlame component provides memory-resident command execution, file reading and writing, and intermediate command-and-control relay functionality. It accepts tasking through SD-WAN control traffic and can forward communications between an upstream command server and multiple peers. Deployment mechanisms include ptrace-based process injection and packed loaders. Persistence relies on modified runit initialization scripts and malicious services masquerading as legitimate components. Additional evasion techniques include encrypted payloads, anti-debugging checks, and timestomping.
The LittleFilch component hooks decrypted control-session reads to collect sensitive keying material and associated edge-router metadata for a predefined set of devices. It encrypts collected records with RSA, stages them locally, and supports transmission over UDP using records resembling DTLS application data. Actual transmission of the collected keys was not confirmed.
UAT-11473's operating infrastructure substantially overlaps Silent Train, a compromised-device network used by Volt Typhoon. This infrastructure overlap does not establish that UAT-11473 and Volt Typhoon are the same actor.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
According to Talos, the malware framework, named KeyDrift, was designed to give its operators persistent access to the SD-WAN controllers and to automatically siphon off keying material.
11 distinct techniques documented for this family, organized by ATT&CK tactic.
Code = 0x100: Execute command using “/bin/sh -c <command>”
PolyFlame uses dlsym(RTLD_NEXT, ...), dlopen, and runtime interposition
Modified runit service scripts launch KeyDrift components
Malicious service paths under etc/sv/sshd/ and etc/sv/aaamgr/
Modified runit service scripts launch KeyDrift components
rsshd injects libdssl.so into vdaemon by PID
Malicious service paths under etc/sv/sshd/ and etc/sv/aaamgr/
aaamgrd is a statically linked ELF64 executable with no section headers, a single RWE loader segment, and an RC4-encrypted embedded ELF payload.
sshd and aaamgr service-name masquerading
rsshd injects libdssl.so into vdaemon by PID
touch --reference= and chmod --reference= staging commands copied reference file metadata
It performs an anti-debug check by deobfuscating /proc/%d/status and TracerPid: and exits if a tracer is present.
PolyFlame uses dlsym(RTLD_NEXT, ...), dlopen, and runtime interposition
PolyFlame and LittleFilch intercept SD-WAN control-plane traffic
PolyFlame and LittleFilch intercept SD-WAN control-plane traffic
It performs an anti-debug check by deobfuscating /proc/%d/status and TracerPid: and exits if a tracer is present.
PolyFlame AES implementation; aaamgrd RC4 packer; LittleFilch RSA-encrypted records
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.