Key Takeaways
- Cisco Talos said on October 28, 2026, that the hacking group UAT-11473 exploited Cisco Catalyst SD-WAN flaw CVE-2026-20127 to install KeyDrift, a custom malware framework built for long-term access and the theft of encryption key material.
- UAT-11473 targeted space and satellite services, defense and aerospace technology, and policy research organizations, according to Cisco Talos.
- Cisco Talos assessed with high confidence that UAT-11473's infrastructure overlaps considerably with Volt Typhoon's Silent Train covert network, but did not say the two are the same group.
- Cisco rates CVE-2026-20127 critical with a score of 10 out of 10, says no workarounds exist, and lists fixed Catalyst SD-WAN releases 20.9.8.2, 20.12.5.3, 20.12.6.1, 20.15.4.2, and 20.18.2.1.
What happened
Cisco Talos, Cisco's threat intelligence group, reported on October 28, 2026, that a group it tracks as UAT-11473 exploited CVE-2026-20127, a flaw that lets attackers get past the authentication of Cisco Catalyst SD-WAN (software-defined wide area network) controllers. Talos described UAT-11473 as a highly sophisticated advanced persistent threat (APT) actor.
After gaining access, the group installed a custom malware framework that Talos named KeyDrift. Talos assessed with high confidence that KeyDrift is designed to provide long-term persistent access and automated exfiltration of sensitive keying material. According to SecurityWeek, Talos believes that material includes the keys protecting traffic that crosses the SD-WAN network.
KeyDrift's main component, PolyFlame, works as a backdoor and can relay the attackers' commands to other systems, Talos said. A second component, LittleFilch, collects the key material. Variations in the samples suggest the framework is under active development, according to Talos.
Talos calls the activity historical and has not said when the attacks occurred, SecurityWeek reported. On October 28, Cisco updated its security advisory for the flaw to point customers to the Talos report.
Who was targeted
UAT-11473 targeted organizations in space and satellite services, defense and aerospace technology, and policy research, according to Talos.
The flaw affects Cisco Catalyst SD-WAN Controller, Manager, and Validator regardless of device configuration, in on-premises deployments and in Cisco's hosted SD-WAN cloud, including its FedRAMP environment, according to Cisco's advisory. Cisco rates it critical, with a score of 10 out of 10. Cisco says an attacker without credentials can use it to gain administrative privileges and change the configuration of the SD-WAN network.
The Volt Typhoon link
Talos assessed with high confidence that UAT-11473's operating infrastructure "overlaps considerably with Volt Typhoon's 'Silent Train' covert access network." Talos does not say the two are the same group, SecurityWeek noted.
The same day, Lumen Technologies' Black Lotus Labs published research on Silent Train. Lumen describes Volt Typhoon as a state-sponsored group from the People's Republic of China and says it has tracked Silent Train for three years. The network routes the group's activity through rotating chains of hacked small office and home routers, internet-connected devices, and enterprise systems, which the operators clean up after each session.
Lumen said its monitoring led to hundreds of victim notifications. SecurityWeek reported that it also helped uncover at least four confirmed zero-day campaigns, targeting Versa Director, N-able N-central, Cisco Catalyst SD-WAN, and VeloCloud Orchestrator, plus a likely one against Quest KACE. A zero-day is a flaw that attackers use before a fix is available.
According to Lumen, Volt Typhoon was exploiting CVE-2026-20127 by late 2025 and kept exploiting it well after Cisco disclosed the flaw in February 2026. Lumen's report does not mention KeyDrift or UAT-11473, according to SecurityWeek.
Lumen said Silent Train victims included telecommunications providers, government, defense contractors, satellite and mission-critical communication services, universities, IT firms, and critical infrastructure, with Hawaii, California, and Texas the most targeted. It said the pattern is consistent with efforts to pre-position access in communications, critical infrastructure, and other systems that become essential during geopolitical tensions or crises.
Black Lotus Labs researcher Mike Horka told journalist Kim Zetter that the group has also taken documents related to military operations and network structures. "I don't think they are just trying to preposition or espionage; I think it's a combination of the two," Horka said.
Earlier attacks on the same flaw
Cisco first published its advisory for CVE-2026-20127 on February 25, 2026, and says it is aware of limited exploitation. Cisco credits the Australian Signals Directorate's Australian Cyber Security Centre with reporting the flaw.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on February 25, with a February 27 deadline for federal agencies, and issued Emergency Directive 26-03 on Cisco SD-WAN systems, according to the catalog entry. BleepingComputer reported that a cluster tracked as UAT-8616 has exploited the flaw as a zero-day since at least 2023.
What organizations should do
Cisco says no workarounds address the flaw and recommends upgrading to a fixed release: 20.9.8.2, 20.12.5.3, 20.12.6.1, 20.15.4.2, or 20.18.2.1, depending on the release in use. Customers on releases earlier than 20.9 must migrate to a fixed release. Cisco also recommends blocking access to the systems from the internet, or limiting it to known, trusted hosts, and sending logs to an external server.
Talos urges organizations to prioritize the patches, follow Cisco's hardening guide for Catalyst SD-WAN, monitor for signs of post-compromise activity, and activate their incident response plans if they find unauthorized activity. Talos published the technical details of KeyDrift in its report.
Lumen recommends reducing the internet exposure of administrative interfaces, prioritizing patches for management and control systems, extending log retention, and following CISA and UK National Cyber Security Centre (NCSC) guidance on Volt Typhoon.