Cisco Talos describes historical activity by UAT-11473 on Cisco Catalyst SD-WAN controllers. The group allegedly exploited CVE-2026-20127 to access devices and then deployed the KeyDrift malware framework. Talos says it was designed to maintain a foothold and collect sensitive control-plane information.
Activity on the controllers
SD-WAN controllers manage connections and policies across a network of sites. Talos says UAT-11473 exploited an authentication flaw in the controller, then used startup scripts to install KeyDrift components inside legitimate processes.
Talos calls the activity historical and does not provide a specific timeframe. The report therefore does not confirm attacks are happening now or identify specific victims.
What KeyDrift is designed to do
Talos describes several components. PolyFlame can provide persistent access and relay commands. LittleFilch is designed to inspect decrypted control traffic and collect keying material, which may then be stored in encrypted form for exfiltration.
That capability is concerning because a controller concentrates information used by devices across an SD-WAN fabric. But a described function does not prove that every targeted item was successfully sent to the operators. Talos does not provide an exfiltration accounting for each observed environment.
What administrators can do
Check that affected Cisco controllers, managers and validators run a fixed release listed in the official advisory. Fixing the access vulnerability and hunting for post-compromise activity answer different questions: a device that is now patched may have been compromised before the update.
Talos published indicators and detection rules. Compare controller files, service scripts and logs with Cisco and Talos guidance. If you find persistence, isolate the equipment under your incident procedure, preserve evidence for investigation and contact Cisco TAC.
Attribution needs care
Talos assesses with high confidence that UAT-11473’s infrastructure overlaps considerably with the “Silent Train” covert network that Lumen attributes to Volt Typhoon. Infrastructure overlap alone does not prove that the names refer to exactly the same group. Keep that distinction when sharing or using the report.
The connection to Soclyde
Controlled management of privileged accounts and passwords is one part of organizational security, but it does not replace updates and monitoring for network controllers. Soclyde keeps an encrypted vault on users’ devices rather than in a centralized cloud vault operated by Soclyde. Read our guide to local and cloud password storage.
Key points
Talos’s report shifts attention from a vulnerability notice to a compromise investigation: it describes an implant designed to persist in SD-WAN controllers and access control-plane information. Apply fixes, then hunt for persistence even if equipment is now up to date.
