KeyDrift malware steals SD-WAN control-plane keys via in-process injection
The claim
The authors assert that the KeyDrift framework provides persistent in-band access to Cisco SD-WAN controllers and extracts decrypted control-plane keying material.
Published as: “Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN”
So what
The work shows that attackers can gain long-term, in-band access to SD-WAN control planes and steal cryptographic keys, highlighting the need for rapid patching of CVE-2026-20127.
The five-minute version
Talos observed the APT group UAT-11473 exploiting CVE-2026-20127 to install a custom malware suite called KeyDrift on Cisco SD-WAN controllers. The framework’s primary component, PolyFlame, is injected into the vdaemon process and interposes socket, DTLS and dynamic-linker calls, giving the attacker a backdoor and an intermediate C2 inside the control plane. A second component, LittleFilch, hooks SSL_read to harvest decrypted control-plane buffers and exfiltrates AES-256 IPsec key material in RSA-encrypted files. The analysis is based on real compromised devices and includes MITRE ATT&CK mapping and Snort signatures.
What they found 3
- KeyDrift can extract OMP-distributed AES-256 IPsec data-plane key material from decrypted control traffic
“Assessed OMP-distributed AES-256 IPsec data-plane key material”
- PolyFlame is injected into legitimate running vdaemon processes to gain control-plane visibility
“PolyFlame is injected into legitimate running vdaemon processes, and it can also masquerade as a packed “aaamgrd” loader variant.”
- LittleFilch records the extracted keying material and RSA-encrypts it before staging
“LittleFilch records the extracted keying material and RSA-encrypts it before writing the output to “/var/tmp/vdaemon.bin”.”
What undercuts it the paper’s own results
- No hardcoded IPv4 addresses, binding ports, callback domains, URLs, host headers, or polling interval were recovered from the analyzed PolyFlame samples.
- Talos has not been able to recover the “vdaemon.conf” file that configures LittleFilch exfiltration endpoints.
Stated limits 3
- Exact command format for PolyFlame tasking is unresolved.
- The configuration file used by LittleFilch (vdaemon.conf) could not be recovered.
- C2 infrastructure details (IP addresses, domains) were not observed.
What’s new here 4
- Identification of a new APT group (UAT-11473) leveraging CVE-2026-20127 against Cisco SD-WAN.
- Discovery of the custom KeyDrift framework with PolyFlame and LittleFilch components that inject into SD-WAN controller daemons.
- Demonstration of in-process DTLS interception to extract OMP-distributed AES-256 IPsec data-plane keys.
- Release of Snort IDS signatures covering the observed malicious artifacts.
Artifacts & methods 6
- KeyDrift frameworksystem
- PolyFlameprimitive
- LittleFilchprimitive
- rsshdprimitive
- conf_sshdprimitive
- aaamgrdprimitive