Loading malware…
PolyFlame is a memory-resident backdoor and command-and-control relay component of the KeyDrift malware framework targeting Linux-based Cisco Catalyst SD-WAN control appliances. It is associated with UAT-11473, which exploited the authentication-bypass vulnerability CVE-2026-20127 to deploy KeyDrift. Observed targeting includes space and satellite services, defense and aerospace technology, and policy research organizations.
PolyFlame runs inside legitimate vdaemon control-plane processes, where it intercepts socket, DTLS, and dynamic-linker operations. It accepts in-band tasking through SD-WAN control traffic rather than relying on a hardcoded external command-server address. Its TinyShell-like backdoor supports arbitrary shell-command execution, file writing, and file reading and transmission, but does not provide an interactive shell. Its relay mode connects an upstream command server with multiple peers and supports bidirectional forwarding, peer creation, and peer removal. Incoming tasking is validated using an MD5 value derived from the appliance’s current local date.
Deployment mechanisms include ptrace-based injection into existing processes and a packed loader launched through a malicious service. Modified initialization scripts and service configurations provide persistent execution. The packed-loader variant uses an encrypted embedded payload and exits when tracing is detected. These mechanisms embed the implant within legitimate appliance activity and hinder analysis.
UAT-11473’s infrastructure substantially overlaps Silent Train, a compromised-device network used by Volt Typhoon; this overlap does not establish that the two actors are identical.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
PolyFlame runs in memory inside vdaemon. It can act as a TinyShell-like backdoor that runs commands and reads and writes files, or as a relay that forwards commands between its command server and other machines.
11 distinct techniques documented for this family, organized by ATT&CK tactic.
Code = 0x100: Execute command using “/bin/sh -c <command>”
PolyFlame uses dlsym(RTLD_NEXT, ...), dlopen, and runtime interposition
Modified runit service scripts launch KeyDrift components
Malicious service paths under etc/sv/sshd/ and etc/sv/aaamgr/
Modified runit service scripts launch KeyDrift components
rsshd injects libdssl.so into vdaemon by PID
Malicious service paths under etc/sv/sshd/ and etc/sv/aaamgr/
aaamgrd is a statically linked ELF64 executable with no section headers, a single RWE loader segment, and an RC4-encrypted embedded ELF payload.
sshd and aaamgr service-name masquerading
rsshd injects libdssl.so into vdaemon by PID
touch --reference= and chmod --reference= staging commands copied reference file metadata
It performs an anti-debug check by deobfuscating /proc/%d/status and TracerPid: and exits if a tracer is present.
PolyFlame uses dlsym(RTLD_NEXT, ...), dlopen, and runtime interposition
PolyFlame and LittleFilch intercept SD-WAN control-plane traffic
PolyFlame and LittleFilch intercept SD-WAN control-plane traffic
It performs an anti-debug check by deobfuscating /proc/%d/status and TracerPid: and exits if a tracer is present.
PolyFlame AES implementation; aaamgrd RC4 packer; LittleFilch RSA-encrypted records
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.