Status box

Field As of 9 November 2026
Name UAT-11473, a Talos designation for a "highly sophisticated" APT. No other published name; no nationality or sponsor stated.
Evidence base One Talos investigation, 28 October 2026, framed as historical activity, with no intrusion dates. Talos KeyDrift
Relationship to Volt Typhoon Talos assesses with high confidence that UAT-11473's infrastructure "overlaps considerably" with Volt Typhoon's Silent Train network. Talos does not say they are the same operator.
Second source None found.
Research scope 9 November 2026 web and retained-public-report searches for UAT-11473, KeyDrift, PolyFlame, LittleFilch and Silent Train found only secondary news restating Talos or Lumen.

Current assessment, 9 November 2026

Talos describes an actor that entered Cisco Catalyst SD-WAN controllers through CVE-2026-20127 and planted KeyDrift inside vdaemon, where it reads decrypted control traffic and extracts data-plane IPsec keys. Talos assesses with high confidence that KeyDrift is built for long-term access and automated key collection. Separately, without a confidence level, it says observed variations suggest active development. Talos KeyDrift

Three clusters, one vulnerability

Three named clusters are tied to CVE-2026-20127; no source merges them.

Cluster Who reports it Exploitation clock Relationship stated
UAT-8616 Talos, 25 February 2026 Malicious activity dated back to at least 2023. Per intelligence partners, the actor likely reached root via a version downgrade and reportedly exploited CVE-2022-20775. Talos UAT-8616 Not mentioned in the KeyDrift post
Volt Typhoon (Silent Train) Black Lotus Labs (Lumen), 28 October 2026 (publication date verified in Lumen’s post-specific metadata) Exploiting the CVE by late 2025 and well after Cisco's February 2026 disclosure. Lumen Silent Train No mention of UAT-11473 or KeyDrift
UAT-11473 Talos, 28 October 2026 None given; "historical" in the title Talos KeyDrift Infrastructure overlap with Silent Train

These are vulnerability-exploitation clocks, not victim dwell times.

Lumen contrasts Silent Train with botnets and operational relay box (ORB) networks. It describes chains rebuilt on demand for carefully selected targets and dismantled after each session, with device types in fixed roles, and says Volt Typhoon reserved the network for exploitation, credential access and exfiltration. Lumen Silent Train TIR assessment: on Lumen's description, considerable overlap is a stronger signal than overlap in a commodity relay pool. It still does not establish one operator, and Talos does not claim one. Compromised relays can also be reused by others. UAT-11473 is labelled neither Volt Typhoon nor Chinese until a source says so.

Access: CVE-2026-20127

A peering-authentication flaw lets an unauthenticated remote attacker log in as an internal high-privileged non-root account and use NETCONF to change fabric configuration (CVSS 10.0). It affects Controller (vSmart), Manager (vManage) and Validator (vBond) in every deployment type, with no workaround. Published 25 February 2026, the advisory added Validator on 16 June and the KeyDrift link on 28 October. Cisco credits ASD's ACSC and reports limited exploitation. Cisco advisory

ENISA's record EUVD-2026-8675 maps to CVE-2026-20127 (updated 16 June 2026). Its "exploited since" field reads 25 February 2026, the disclosure date. TIR reading: that is not when exploitation began, which Talos puts at 2023 and Lumen at late 2025.

Cisco's first fixed releases:

Release First fixed release
Earlier than 20.9 Migrate to a fixed release
20.9 20.9.8.2
20.11 20.12.6.1
20.12 20.12.5.3 or 20.12.6.1
20.13, 20.14, 20.15 20.15.4.2
20.16, 20.18 20.18.2.1

Cisco marks releases earlier than 20.9, and 20.11, 20.13, 20.14 and 20.16, as past End of Software Maintenance.

KeyDrift as Talos reports it

Component Function
Trojanised sshd launcher (/etc/sv/sshd/run) Remounts /rootfs.rw executable, launches the loader in the background, then starts the legitimate sshd
Malicious aaamgr service (/etc/sv/aaamgr/), on an affected vBond Masquerades as aaamgr (genuinely a Python package) and runs packed aaamgrd directly: a static ELF carrying RC4-encrypted PolyFlame, with an anti-debug check
conf_sshd Records vdaemon PIDs in /tmp/system-vdaemon, calls the injector
rsshd Injects PolyFlame into vdaemon using ptrace
PolyFlame (libdssl.so) Hooks socket, DTLS and linker calls; TinyShell-like backdoor (command, file read, file write) or one-to-many intermediate C2
LittleFilch (libcommon.so) SSL_read hook in vSmart's vdaemon; extracts vEdge IPs and 32-byte keys Talos assesses as OMP-distributed AES-256 IPsec keys
/var/tmp/vdaemon.bin, vdaemon.conf RSA-encrypted staging; endpoint config deleted after reading

Tasking is in-band; Talos recovered no hardcoded C2 address, port or domain. PolyFlame acts only if the C2 sends the MD5 of the device's date. LittleFilch can send records over UDP as DTLS 1.2-style data. Talos reports indications of timestomping: staging commands ran touch and chmod with --reference. It has not recovered vdaemon.conf, so the exfiltration destination is unknown. Talos KeyDrift

Targeting

Talos reports space and satellite services, defence and aerospace technology, and policy research, with no countries or victim count. Lumen's Silent Train victims include satellite communications and defence contractors; shared sectors are not a shared operator. Talos KeyDrift, Lumen Silent Train

Persistence limits

KeyDrift persists through runit service scripts and runs from memory in vdaemon. Talos does not say whether an upgrade removes it, and reports nothing in firmware or boot. TIR assessment: a patched controller stays suspect until its service scripts match a known-good image.

Detection opportunities

Illustrative, untested; Talos artefacts unless marked.

Behaviour Where to look False positives
Modified launchers /rootfs.rw remount plus a background script in /etc/sv/sshd/run; any ELF under /etc/sv/aaamgr/ Upgrades; compare like-for-like releases
Injected libraries libdssl.so or libcommon.so in /proc/<vdaemon pid>/maps; /tmp/system-vdaemon, /var/tmp/vdaemon.bin Few expected
Unauthorised peering and root use Peering events against approved vEdges; root Accepted publickey and system-login-change entries CISA supplemental; unknown-IP Accepted publickey for vmanage-admin in /var/log/auth.log Cisco advisory Maintenance windows and new sites
Key exfiltration Controller UDP with DTLS-like records to a non-fabric address Legitimate DTLS
Signatures Snort 65938, 65958 (CVE); Snort 2 67387–67416 and Snort 3 7:44–7:73 (KeyDrift) Per vendor

Mitigation and recovery

  • Upgrade; until then restrict ports 22 and 830 to known controller IPs and apply Cisco's hardening guide. Cisco advisory
  • Capture evidence before patching. CISA's ED 26-03 (updated 11 March 2026; also covers CVE-2022-20775) required federal agencies to take admin-tech output and disk and memory snapshots and to hunt. On root compromise it requires fresh vManage, vSmart and vBond instances from patched OVA or qcow2 images, with edges migrated. CISA ED 26-03 Hunt steps are in CISA's supplemental direction, built on the ASD-led joint Hunt Guide. CISA supplemental
  • That Hunt Guide, co-sealed by ASD's ACSC, NSA, CISA, the Canadian Cyber Centre, NCSC-NZ and NCSC-UK, appears to be the partners' guide Talos's UAT-8616 post points to. Its priority actions are hunting, collecting artefacts, updating and applying Cisco's hardening guide; the hardening items it highlights include pairwise keying and remote syslog. NCSC-UK joint alert
  • TIR assessment: where KeyDrift ran, the actor could potentially read the data plane, so treat data-plane keys and controller credentials as exposed and rebuild on the ED 26-03 pattern with Cisco TAC. Pairwise keying may narrow what one stolen key exposes; untested against KeyDrift.

Open questions

  1. Did UAT-11473's activity precede the February 2026 disclosure, follow it, or both?
  2. Is UAT-11473 related to UAT-8616? Talos has not said.
  3. Does the Silent Train overlap reflect one operator or shared relays?
  4. Where did LittleFilch send its records?

Related TIR coverage

Sources

  • Cisco Talos, Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN, 28 October 2026. Talos KeyDrift
  • Cisco Talos, Active exploitation of Cisco Catalyst SD-WAN by UAT-8616, 25 February 2026. Talos UAT-8616
  • Cisco PSIRT, cisco-sa-sdwan-rpa-EHchtZk, version 2.1, 28 October 2026. Cisco advisory
  • ENISA, EUVD-2026-8675, updated 16 June 2026. EUVD-2026-8675
  • CISA, ED 26-03, updated 11 March 2026. CISA ED 26-03
  • CISA, Supplemental Direction ED 26-03: Hunt and Hardening Guidance, 25 February 2026. CISA supplemental
  • NCSC-UK, Exploitation of Cisco Catalyst SD-WAN, joint alert on the ASD-led Hunt Guide, 25 February 2026. NCSC-UK joint alert
  • Black Lotus Labs (Lumen), Silent Train: uncovering Volt Typhoon's operational framework; undated page, 28 October 2026 per secondary coverage. Lumen Silent Train

Version history

Version 1, 31 October 2026 (revised after review): initial evidence-limited profile from the Talos investigation, with the Cisco advisory history and fixed releases, the EUVD record, CISA's evidence-capture requirements, the three-cluster comparison and a dated negative search for a second source.

Research refreshed on 9 November 2026. Source publication dates and the dates of the underlying activity remain distinct; this is a researched assessment, not a claim of newly observed activity on the publication day.