#keydrift

October 30, 2026

Talos detailed KeyDrift, a custom framework deployed on Catalyst SD-WAN Controllers via CVE-2026-20127, the max-severity auth bypass Cisco fixed in February. Components PolyFlame (runs inside legitimate vdaemon processes, TinyShell-style command execution, peer relaying) and LittleFilch (hooks SSL_read to extract control-session metadata and 32-byte AES-256 IPsec data-plane keys) target space and satellite services, defence and aerospace, and policy research organisations. Talos describes the intrusions as historical and says the UAT-11473 cluster overlaps Volt Typhoon's "Silent Train" covert access network without drawing a definitive link (BleepingComputer, SC World). (earlier coverage) · Exploitation at the Network Edge