What happened

• UAT-11473 exploited CVE-2026-20127, an authentication bypass in Cisco Catalyst SD-WAN Controller instances [S1].
• The actor modified runit service run scripts, remounted /rootfs.rw as executable and launched conf_sshd in the background [S1].
• conf_sshd records vdaemon PIDs in /tmp/system-vdaemon. It then uses the rsshd ptrace injector to load PolyFlame (libdssl.so) into vdaemon [S1].
• LittleFilch (libcommon.so) hooks SSL_read in vdaemon to steal data-plane keys. It RSA-encrypts them into /var/tmp/vdaemon.bin and can send them over UDP [S1].
• A compiled ELF aaamgrd runs under /etc/sv/aaamgr/. The legitimate aaamgr is a Python package [S1].
• KeyDrift infrastructure overlaps with Volt Typhoon's Silent Train network [S1][S2].

Timeline

Detect

KeyDrift file and process artifacts · SD-WAN controller file integrity monitoring / process execution logs

index=* ("/var/tmp/vdaemon.bin" OR "/var/tmp/vdaemon.conf" OR "/tmp/system-vdaemon" OR "libdssl.so" OR "libcommon.so" OR "rsshd" OR "conf_sshd" OR "aaamgrd") | stats count min(_time) as first max(_time) as last by host, source

A hit means: A KeyDrift component or its key staging file exists on a controller. Treat this as probable compromise with possible data-plane key theft.

Executable remount of /rootfs.rw · Controller shell history / auditd

index=* "rootfs.rw" ("remount" OR "mount") ("exec" OR "/etc/sv/") | table _time host user _raw

A hit means: A runit run script or operator remounted the read-only root as executable, as the trojanized scripts do. Compare against change records.

Timestomping with --reference · Controller shell history / auditd execve

index=* ("touch --reference=" OR "chmod --reference=") | table _time host user _raw

A hit means: File metadata was copied to disguise modified files, as UAT-11473 did. Inspect the target files, especially those under /etc/sv/.

Talos Snort SIDs for CVE-2026-20127 · Network IPS alerts

index=* ("1:65938:" OR "1:65958:" OR "65938" OR "65958") | stats count by src, dest

A hit means: Traffic matched Talos signatures for CVE-2026-20127 exploitation against the destination controller. Check that controller for the on-box artifacts.

Verify

• Inspect /etc/sv/*/run scripts on each controller for added mount, conf_sshd or background launch lines [S1].
• An ELF binary named aaamgrd under /etc/sv/aaamgr/ is anomalous. The legitimate aaamgr is Python [S1].
• Check for injected libdssl.so or libcommon.so in the memory maps of vdaemon processes [S1].
• Benign look-alikes: Cisco TAC or upgrade procedures may remount filesystems or edit service scripts. Confirm against the change ticket. Note that timestamps may be forged by the --reference timestomping [S1].

Scope

Affected

• Cisco Catalyst SD-WAN Controller/Manager components (vSmart, vBond) vulnerable to CVE-2026-20127 [S1]

Only if

• SD-WAN controller peering is reachable by the attacker

Not affected if

• Cisco patches for CVE-2026-20127 are applied. Prior compromise is still possible.

Enumerate

• All SD-WAN controller, validator and manager instances, with their versions and patch state
• The exposure of controller peering and control-connection interfaces to the internet or untrusted networks
• Control connection peering events from unexpected peers
• Data-plane keys and edge devices served by any controller with artifacts
• Outbound UDP from controllers to unknown destinations

Contain

• Restrict controller peering and management access to known peers and admin networks.
• Before any reboot or reimage, preserve evidence: memory of vdaemon processes, /etc/sv/, /var/tmp/vdaemon.*, /tmp/system-vdaemon and shell history. A reboot loses the in-memory injection state, and this cannot be undone.
• Block outbound UDP from controllers to destinations other than known infrastructure.
• Apply Cisco's fix for CVE-2026-20127. Patching does not remove an existing implant.
• Keys already exfiltrated cannot be recalled. Plan their rotation (see Recover).

Eradicate

• Restore the original runit run scripts, including /etc/sv/sshd/run and /etc/sv/aaamgr/run [S1].
• Remove conf_sshd, rsshd, libdssl.so, libcommon.so, the ELF aaamgrd, /var/tmp/vdaemon.bin, /var/tmp/vdaemon.conf and /tmp/system-vdaemon [S1].
• Prefer a rebuild from known-good images over in-place cleaning, because the actor timestomped files [S1].

Recover

• Validate the patched version and clean run scripts before reconnecting controllers.
• Rotate data-plane keys and controller credentials, since LittleFilch targets data-plane keys [S1]. Rotation is an inference; the sources give no vendor rotation guidance.
• Afterwards, monitor for re-modification of /etc/sv/, /rootfs.rw remounts and the Talos SIDs [S1].

Re-enter the loop when

• Cisco updates the advisory, adds affected products or versions, or adds workarounds.
• Talos or others publish new KeyDrift IoCs, C2 infrastructure or network indicators.
• Artifacts are found on a controller thought to be patched before exploitation.
• Exploitation is reported against other SD-WAN components or edge devices.

Debrief

• Record when each controller was patched, against the first exploitation evidence.
• Record whether data-plane keys were staged or exfiltrated, and when rotation completed.
• Gap: the sources give no fixed version numbers or advisory link.
• Gap: no network C2 indicators (IPs or domains) are listed in the input.
• Gap: exploitation start date and victim sectors are not given.

Detection coverage — checked automatically

Checked automatically 2026-10-29 17:09Z from public sources: 8 published, 16 nothing found, 0 not machine-checkable, 3 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

vuln:CVE-2026-20127

cpe:"cpe:/a:cisco:catalyst_sd-wan_manager"

product:"Catalyst Sd-wan Manager"

host.services: (software.product = "Catalyst Sd-wan Manager")

cpe:"cpe:/a:cisco:sd-wan_vbond_orchestrator"

product:"Sd-wan Vbond Orchestrator"

host.services: (software.product = "Sd-wan Vbond Orchestrator")

cpe:"cpe:/a:cisco:sd-wan_vsmart_controller"

product:"Sd-wan Vsmart Controller"

host.services: (software.product = "Sd-wan Vsmart Controller")

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-10-29 17:09Z from the CVE ids and NVD's CPE configurations; re-built daily with the coverage check.

Open questions

• Which software releases fix CVE-2026-20127, and what is the Cisco advisory ID?
• Is this listed in CISA KEV, and when did exploitation begin?
• Does the Silent Train overlap imply Volt Typhoon involvement, or only shared infrastructure?
• Does Cisco recommend key or certificate rotation after compromise?

Sources

• [S1] https://blog.talosintelligence.com/uat-11473-keydrift/ · Cisco Talos Blog
• [S2] https://www.securityweek.com/cisco-sd-wan-zero-day-exploitation-tied-to-volt-typhoons-silent-train-network/ · SecurityWeek

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically once it crosses the publish bar.