UAT-11473 — bu KeyDrift deb nomlangan maxsus zararli dastur tizimini joylashtirayotgan ilg‘or doimiy tahdid aktori bo‘lib, u Cisco Catalyst SD-WAN kontrollerlarini nishonga oladi.
Ushbu tizim qonuniy boshqaruv tekisligi jarayonlari ichiga joylashib, kirishni saqlab qoladi, shifrlangan aloqalarni ushlab qoladi va sezgir tarmoq shifrlash materiallarini chiqarib oladi.
Kuzatilgan nishonlar kosmik va sun’iy yo‘ldosh xizmatlari, mudofaa va aerokosmik texnologiyalar hamda siyosiy tadqiqotlar sohalarini qamrab oladi.
Talos yuqori ishonch bilan baholaydiki, aktorning operatsion infratuzilmasi Volt Typhoon’ning Silent Train tarmog‘i bilan sezilarli darajada mos keladi, garchi infratuzilma mosligi o‘zi bu kuzatuv nomlari bir xil aktorni anglatishini isbotlamaydi.
Maxsus tayyorlangan so‘rovlar noto‘g‘ri tengdosh autentifikatsiyasidan foydalanib, autentifikatsiyadan o‘tmagan masofaviy hujumchiga ichki, yuqori imtiyozli, root bo‘lmagan hisob orqali kirish imkonini beradi.
Bu kirish, shuningdek, SD-WAN mato konfiguratsiyasini manipulyatsiya qila oladigan NETCONF funksiyasini ham ochib beradi.
Nishon olish Lumen Black Lotus Labs’ning Silent Train tekshiruvi bilan mos keladi, u Volt Typhoon’ning markazlashtirilgan boshqaruv platformalariga qarshi aylanuvchi buzilgan infratuzilmani ishlatishini hujjatlashtiradi.
Lumen Cisco zaifligidan foydalanish 2025-yil oxirida boshlanganini va 2026-yil fevral oyidagi oshkor etilishidan keyin ham davom etganini xabar qiladi.
KeyDrift o‘zgartirilgan runit xizmat ishga tushiruvchilari orqali bajarilishini mustahkamlaydi. Bir joylashtirishda o‘zgartirilgan sshd ishga tushiruvchisi /rootfs.rw ni bajarish ruxsat etilgan holda qayta o‘rnatadi va conf_sshd ni fon rejimiga o‘tkazib, qonuniy SSH xizmatlarini ishga tushirishdan oldin ishga tushiradi.
Skript ishlayotgan vdaemon jarayonlarini sanaydi, ularning identifikatorlarini /tmp/system-vdaemon ga yozadi va rsshd in’ektorini chaqirib, libdssl.so sifatida joylashtirilgan PolyFlame’ni har bir jarayonga yuklaydi.
PolyFlame soket va ish vaqti xatti-harakatlarini, jumladan recvfrom, sendto, dlopen va dlsym ni bog‘laydi.
conf_sshd boshqaruv oqimi mantiqi (Manba: Cisco Talos).
vdaemon ichida ishlash unga alohida yakuniy nuqta mayoqining sezilarli izini qoldirmasdan boshqaruv tekisligi holatiga kirish imkonini beradi. Qurilmaning joriy sanasi MD5 xesh-digesti kiruvchi topshiriqlarni nazorat qiladi.
Uning TinyShell uslubidagi orqa eshigi ixtiyoriy buyruqlarni, fayl yuklashni va fayl olishni qo‘llab-quvvatlaydi, lekin interaktiv qobiqni emas.
Cisco Talos GBhackers bilan baham ko‘rgan hisobotida aytishicha, UAT-11473 Cisco Catalyst SD-WAN Controller, Manager va Validator’ga ta’sir qiluvchi CVSS 10.0 autentifikatsiya chetlab o‘tish zaifligi CVE-2026-20127 dan foydalangan.
SD-WAN kontrollerlari nishonga olingan
Alohida relay rejimi bitta yuqori darajadagi kontroller bilan bir nechta tengdoshlarni bog‘lab, buyruqlar va javoblarni buzilgan infratuzilma orqali yo‘naltiradi.
Ikkinchi variant aaamgrd sifatida niqoblanadi — bu kutilgan Python asosidagi komponent o‘rnini egallaydigan kompilyatsiya qilingan ELF bajariladigan fayl.
Uning yuklovchisi RC4 bilan shifrlangan yukni o‘z ichiga oladi, to‘g‘ridan-to‘g‘ri tizim chaqiruvlaridan foydalanadi va davom etishdan oldin TracerPid ni tekshirib, disk raskadrovka bor-yo‘qligini aniqlaydi.
PolyFlame joylashtirish ketma-ketligi (Manba: Cisco Talos).
libcommon.so sifatida joylashtirilgan LittleFilch KeyDrift’ning to‘plash qobiliyatini ta’minlaydi. U vdaemon ichida SSL_read ni bog‘laydi va oldindan belgilangan chekka tugunlari bilan bog‘liq shifrlangan boshqaruv sessiya buferlarini tekshiradi.
Xabar hajmi, dastlabki bayt va marker ketma-ketliklarini tekshirgandan so‘ng, modul umumiy transport manzillarini, tengdosh tizim manzillarini va OMP orqali tarqatilgan AES-256 IPsec ma’lumot tekisligi kalitlash materiali deb baholangan 32 baytli ikkilik maydonni chiqarib oladi.
LittleFilch to‘plangan yozuvlarni RSA bilan shifrlaydi va /var/tmp/vdaemon.bin ga yozadi. U shifrlangan mazmunni DTLS 1.2 ilova ma’lumotlariga o‘xshash yozuvlar yordamida UDP orqali uzatishi mumkin.
Konfiguratsiya /var/tmp/vdaemon.conf dan keladi, u o‘qilgandan keyin o‘chiriladi; Talos bu faylni tiklay olmadi.
Cisco tuzatishlarni chiqardi va zaiflikni hech qanday yechim bartaraf etmasligini ta’kidlaydi. Administratorlar uning maslahatidan tegishli tuzatilgan relizni tanlashi, kontroller kirishini cheklashi va /var/log/auth.log dagi ruxsatsiz vmanage-admin ochiq kalit kirishlarini tekshirishi kerak.
Cisco, shuningdek, kutilmagan boshqaruv tekisligi tengdosh hodisalarini hujjatlashtirilgan topologiya va texnik xizmat faoliyatiga nisbatan tekshirishni tavsiya qiladi.
KeyDrift tekshiruvlari o‘zgartirilgan runit ishga tushiruvchilarini, kutilmagan kutubxonalarni, shubhali aaamgrd bajariladigan fayllarini va to‘plash artefaktlarini tekshirishi kerak.
Topilmalar har bir buzilgan SD-WAN joylashtirishida avval qo‘lga kiritilgan korporativ trafikni keng ko‘lamli shifrlash emas, balki maqsadli kalit yig‘ishni ko‘rsatadi.
UAT-11473, an advanced persistent threat actor deploying KeyDrift, a custom malware framework targeting Cisco Catalyst SD-WAN controllers.
The framework embeds inside legitimate control-plane processes to maintain access, intercept decrypted communications, and extract sensitive network encryption material.
Observed targets span space and satellite services, defense and aerospace technology, and policy research.
Talos assesses with high confidence that the actor’s operating infrastructure substantially overlaps with Volt Typhoon’s Silent Train network, although infrastructure overlap alone does not establish that both tracking names identify the same actor.
Crafted requests exploit defective peering authentication, granting an unauthenticated remote attacker access through an internal, highly privileged, non-root account.
That access also exposes NETCONF functionality capable of manipulating SD-WAN fabric configuration.
The targeting aligns with Lumen Black Lotus Labs’ Silent Train investigation, which documents Volt Typhoon’s use of rotating compromised infrastructure against centralized management platforms.
Lumen reports exploitation of the Cisco vulnerability beginning in late 2025 and continuing after its February 2026 disclosure.
KeyDrift anchors execution through modified runit service launchers. In one deployment, an altered sshd launcher remounts /rootfs.rw with execution enabled and backgrounds conf_sshd before startinglegitimate SSH services.
The script enumerates running vdaemon processes, records their identifiers in /tmp/system-vdaemon, and invokes the rsshd injector to load PolyFlame, deployed as libdssl.so, into each process.
PolyFlame hooks socket and runtime behavior, including recvfrom, sendto, dlopen, and dlsym.
conf_sshd control flow logic (Source : Cisco Talos).
Operating inside vdaemon gives it access to control-plane state while avoiding the conspicuous footprint of a separate endpoint beacon. An MD5 digest of the device’s current date gates incoming tasking.
Its TinyShell-style backdoor supports arbitrary commands, file uploads, and file retrieval, but not an interactive shell.
Cisco Talos said in a report shared with GBhackers, UAT-11473 exploited CVE-2026-20127, a CVSS 10.0 authentication bypass affecting Cisco Catalyst SD-WAN Controller, Manager, and Validator.
SD-WAN Controllers Targeted
A separate relay mode connects one upstream controller to multiple peers, forwarding commands and responses through compromised infrastructure.
A second variant masquerades as aaamgrd, a compiled ELF executable replacing the expected Python-based component.
Its loader contains an RC4-encrypted payload, uses direct system calls, and checks TracerPid for debugging before proceeding.
PolyFlame staging sequence (Source : Cisco Talos).
LittleFilch, deployed as libcommon.so, supplies KeyDrift’s collection capability. It hooks SSL_read inside vdaemon and examines decrypted control-session buffers associated with predefined edge nodes.
After validating message size, an initial byte, and marker sequences, the module extracts public transport addresses, peer system addresses, and a 32-byte binary field assessed as OMP-distributed AES-256 IPsec data-plane keying material.
LittleFilch RSA-encrypts collected records and writes them to /var/tmp/vdaemon.bin. It can transmit encrypted content over UDP using records resembling DTLS 1.2 application data.
Configuration comes from /var/tmp/vdaemon.conf, which is deleted after reading; Talos did not recover that file.
Cisco has released fixes and states that no workaround resolves the vulnerability. Administrators should select the appropriate fixed release from its advisory, restrict controller access, and investigate unauthorized vmanage-admin public-key logins in /var/log/auth.log.
Cisco also recommends validating unexpected control-plane peering events against documented topology and maintenance activity.
KeyDrift investigations should examine altered runit launchers, unexpected libraries, suspicious aaamgrd executables, and collection artifacts.
The findings indicate targeted key harvesting, not demonstrated blanket decryption of previously captured enterprise traffic across every compromised SD-WAN deployment.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.