UAT-11473
Highly sophisticated APT reported and named by Cisco Talos that exploited CVE-2026-20127, an authentication bypass in Cisco SD-WAN Catalyst Controller, to gain unauthorized access and install the custom KeyDrift malware framework (PolyFlame, LittleFilch), designed for long-term persistent access and automated exfiltration of sensitive keying material from SD-WAN control-plane processes. Observed targeting spans space and satellite services, defense and aerospace technology, and policy research. Talos assesses with high confidence that UAT-11473's operating infrastructure overlaps considerably with Volt Typhoon's Silent Train covert access network; this infrastructure overlap is the only link Talos reports between the two.
CVEs in recent coverage
- 10.0CVE-2026-20127KEVCisco Catalyst SD-WAN Controller and Manager · 1 mention with this actor
Recent victims
No leak-site posts on record for this group.
Recent activity
- Cisco Talos ties KeyDrift malware on Cisco SD-WAN controllers to hacking group UAT-11473 Talos says UAT-11473 bypassed login checks on Cisco SD-WAN controllers mastodon · Nov 4, 2026
- Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN https:// blog.talosintelligence.com/uat -11473-keydrift/mastodon · Nov 3, 2026
- 🔵 THREAT INTELLIGENCE Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware Vulnerability | CRITICAL CVEs: CVE-2026-20127 A newly identified advamastodon · Oct 30, 2026
References
- blog.talosintelligence.com/uat-11473-keydrift
- thehackernews.com/2026/10/hackers-exploited-cisco-sd-wan…
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.