Yangi aniqlangan ilg'or doimiy tahdid (APT) guruhi UAT-11473 nomi bilan kuzatilmoqda va u CVE-2026-20127 — Cisco Catalyst SD-WAN Controllerlaridagi autentifikatsiyani chetlab o'tish zaifligidan foydalanib, KeyDrift nomli maxsus zararli dastur tizimini o'rnatmoqda.
CVE-2026-20127 — bu Cisco 2026-yil fevral oyida tuzatgan maksimal darajadagi zaiflik bo'lib, u masofaviy hujumchilarga Catalyst SD-WAN Controller va Managerga imtiyozli kirish huquqini olish va soxta tengdoshlarni qo'shish imkonini beradi.
UAT-8616 bu zaiflikdan kamida 2023-yildan beri nol-kun zaifligi sifatida foydalanib kelgan va so'nggi tadqiqotlar uning ekspluatatsiyasini Xitoyning Volt Typhoon davlat homiyligidagi xakerlik guruhi bilan ham bog'lagan.
Faoliyat haqida xabar bergan Cisco Talos tadqiqotchilariga ko'ra, UAT-11473 tahdid klasteri Volt Typhoonning "Silent Train" yashirin kirish tarmog'i bilan o'xshashliklarga ega, ammo ular aniq bog'liqlikni tasdiqlamagan.
Lumen kecha e'lon qilgan hisobotda tadqiqotchilar Silent Train tizimi Volt Typhoonga nol-kun zaifligi hujumlarini amalga oshirishda aniqlanmasdan qolish imkonini berganini ochib berdi.
KeyDriftni o'rnatish
Cisco tadqiqotchilari kuzatgan hujumlar kosmik va sun'iy yo'ldosh xizmatlari, mudofaa va aerokosmik texnologiya, hamda siyosat tadqiqot tashkilotlarini nishonga olgan. Ular Cisco SD-WAN controller instansiyalarida ishlash uchun mo'ljallangan maxsus zararli dastur tizimi — KeyDrift zararli dasturidan foydalangan.
"Talos yuqori ishonch bilan baholaydiki, bu tizim uzoq muddatli doimiy kirish va sezgir kalit materialini avtomatlashtirilgan o'g'irlashni ta'minlash uchun mo'ljallangan", deb tushuntirdi Cisco Talos.
"KeyDrift SD-WAN boshqaruv tekisligi jarayonlari ichida ishlaydi va shifrlangan boshqaruv trafikni ushlab qolish, boshqaruv sessiyasi metama'lumotlari va ma'lumot tekisligi kalit materialini ajratib olish, hamda to'plangan materialni shifrlangan yozuvlar yordamida saqlash yoki uzatish qobiliyatiga ega."
KeyDrift ikkita asosiy komponentga ega — PolyFlame va LittleFilch, ularning doimiy rivojlanish belgilari, jumladan yangi anti-debug mexanizmlari va turli jarayon taqlid qilish usullari kuzatilgan.
PolyFlame o'zgartirilgan xizmat ishga tushirish skriptlari va o'rnatish uchun injektor yordamida qonuniy vdaemon jarayonlari ichida ishlaydi.
U TinyShell uslubidagi komponent orqali buyruq bajarishni, fayllarni yuklash va yuklab olishni, hamda hujumchining buyruq-va-boshqaruv (C2) serveri va bir nechta tengdoshlar o'rtasida aloqa uzatishni qo'llab-quvvatlaydi.
LittleFilch — bu boshqaruv sessiyasini ushlab qolish moduli bo'lib, u SSL_read funksiyasini bog'lab, boshqaruv tekisligi xabarlarini controller ichida shifrlangandan keyin tekshiradi.
Oldindan belgilangan chekka tugunlari uchun u IP identifikatorlari va Talos AES-256 IPsec ma'lumot tekisligi kalit materiali deb baholagan 32 baytli maydonni ajratib oladi.
U to'plangan ma'lumotni himoya qilish uchun RSA shifrlashdan foydalanadi, uni /var/tmp/vdaemon.bin fayliga saqlaydi va keyin UDP orqali hujumchilarga uzatadi.
Talos yuqori ishonch bilan KeyDrift Cisco SD-WAN controllerlarida doimiy kirishni saqlab qolish, boshqaruv tekisligi trafikni ushlab qolish, kriptografik kalitlarni ajratib olish va o'g'irlangan ma'lumotlarni xavfsiz saqlash yoki o'g'irlash uchun mo'ljallangan deb hisoblaydi.
Cisco tizim ma'murlariga CVE-2026-20127 uchun mavjud xavfsizlik yangilanishlarini qo'llashni va Catalyst SD-WAN o'rnatishlari uchun sotuvchining maxsus qattiqlashtirish qo'llanmasini ham ko'rib chiqishni tavsiya qiladi.
Hujumchilar haqiqiy ma'lumotlarga ega bo'lgach, ularning harakatlarining faqat 37% to'xtatiladi
Umumiy oldini olish ko'rsatkichlari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy ma'lumotlardan foydalangach, oldini olish keskin pasayadi.
Blue Report 2026 mijozlar ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha texnika-texnika himoyani o'lchaydi.
Hisobotni oling
A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift.
CVE-2026-20127 is a max-severity flaw that Cisco patched in February 2026, which allows remote attackers to gain privileged access to Catalyst SD-WAN Controller and Manager and add rogue peers.
UAT-8616 has exploited the vulnerability as a zero-day since at least 2023, and recent research also linked its exploitation to the Chinese Volt Typhoon state-sponsored hacking group.
According to Cisco Talos researchers who reported on the activity, the UAT-11473 threat cluster appears to overlap with Volt Typhoon’s "Silent Train" covert access network, but they made no definitive links.
In a report Lumen released yesterday, researchers revealed that the Silent Train framework allowed Volt Typhoon to evade detection while conducting zero-day vulnerability attacks.
Deploying KeyDrift
The attacks Cisco researchers observed targeted space and satellite services, defense and aerospace technology, and policy research organizations, using the KeyDrift malware, which is a custom malware framework designed to operate on Cisco SD-WAN controller instances.
"Talos assesses with high confidence that the framework is designed to provide long-term persistent access and automated exfiltration of sensitive keying material," explained Cisco Talos.
"KeyDrift operates inside SD-WAN control-plane processes and is capable of intercepting decrypted control traffic, extracting control-session metadata and data-plane keying material, and staging or transmitting the collected material using encrypted records."
KeyDrift has two primary components, PolyFlame and LittleFilch, for which Talos saw signs of ongoing development, including new anti-debugging mechanisms and varied process impersonation.
PolyFlame runs inside legitimate vdaemon processes using modified service startup scripts and an injector for deployment.
It supports command execution through a TinyShell-styled component, file uploads and downloads, and relaying communications between an attacker’s command-and-control (C2) server and multiple peers.
LittleFilch is a control-session interception module that hooks SSL_read to inspect control-plane messages after they have been decrypted inside the controller.
For predefined edge nodes, it extracts IP identifiers and a 32-byte field that Talos assesses to be AES-256 IPsec data-plane key material.
It uses RSA encryption to protect the collected information, saves it to /var/tmp/vdaemon.bin, and then transmits it over UDP to the attackers.
Talos believes with high confidence that KeyDrift is designed to maintain persistent access to Cisco SD-WAN controllers, intercept control-plane traffic, extract cryptographic keys, and securely stage or exfiltrate the stolen data.
Cisco recommends that system administrators apply the available security updates for CVE-2026-20127 and also consult the vendor’s dedicated hardening guide for Catalyst SD-WAN deployments.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report
