Changed since version 1

• Sources renumbered: Talos is now [S4] and SecurityWeek [S3]. Added BleepingComputer [S1] and The Hacker News [S2].
• fixed_in set to the February 2026 Cisco update; the specific version is still unstated [S1].
• not_affected_if now names the February 2026 fixed release or later [S1].
• Added the reported defense and policy targets to the title, what_happened and triage [S1][S2].
• Added detail that staged data is RSA-encrypted and exfiltrated over UDP to what_happened, verify, contain and recover [S1].
• Added Cisco's SD-WAN hardening guide to contain [S1].
• Noted the source discrepancy on what LittleFilch captures [S4][S1].
• Debrief gaps updated: victim sectors are now named; the fixed version number remains a gap.
• Added timeline, eradicate and reenter_when entries.

What happened

• Talos reports that UAT-11473 exploited CVE-2026-20127, a CVSS 10 authentication bypass in Cisco Catalyst SD-WAN Controllers, and deployed the KeyDrift framework [S4].
• Trojanized runit scripts remount /rootfs.rw as executable and launch conf_sshd. conf_sshd uses the rsshd ptrace injector to load PolyFlame (libdssl.so) into vdaemon. A packed aaamgrd variant runs under /etc/sv/aaamgr/ [S4].
• LittleFilch (libcommon.so) hooks SSL_read in vdaemon. Talos ties it to data-plane key theft [S4]. Reporting describes it as reading control-plane messages after decryption [S1].
• Collected material is RSA-encrypted, saved to /var/tmp/vdaemon.bin and sent over UDP to the attackers [S1].
• KeyDrift infrastructure overlaps with Volt Typhoon's Silent Train network [S3]. Reporting names defense and policy targets [S1][S2].
• Cisco recommends the February 2026 update and its SD-WAN hardening guide [S1].

Timeline

Detect

KeyDrift file and process artifacts · SD-WAN controller file integrity monitoring / process execution logs

index=* ("/var/tmp/vdaemon.bin" OR "/var/tmp/vdaemon.conf" OR "/tmp/system-vdaemon" OR "libdssl.so" OR "libcommon.so" OR "rsshd" OR "conf_sshd" OR "aaamgrd") | stats count min(_time) as first max(_time) as last by host, source

A hit means: A KeyDrift component or its key staging file exists on a controller [S4][S1]. Treat this as probable compromise with possible key theft.

Executable remount of /rootfs.rw · Controller shell history / auditd

index=* "rootfs.rw" ("remount" OR "mount") ("exec" OR "/etc/sv/") | table _time host user _raw

A hit means: A run script or an operator remounted the read-only root as executable, as the trojanized scripts do [S4]. Compare the hit against change records.

Timestomping with --reference · Controller shell history / auditd execve

index=* ("touch --reference=" OR "chmod --reference=") | table _time host user _raw

A hit means: File metadata was copied to disguise modified files, as UAT-11473 did [S4]. Inspect the target files, especially those under /etc/sv/.

Talos Snort SIDs for CVE-2026-20127 · Network IPS alerts

index=* ("1:65938:" OR "1:65958:" OR "65938" OR "65958") | stats count by src, dest

A hit means: Traffic matched Talos signatures for CVE-2026-20127 exploitation against the destination controller [S4]. Check that controller for on-box artifacts.

Verify

• Inspect /etc/sv/*/run scripts on each controller for added mount, conf_sshd or background-launch lines [S4].
• An ELF binary named aaamgrd under /etc/sv/aaamgr/ is anomalous. The legitimate aaamgr is Python [S4].
• Check vdaemon process memory maps for injected libdssl.so or libcommon.so [S4].
• Look for outbound UDP from the controller that matches the creation time of /var/tmp/vdaemon.bin [S1].
• Benign look-alikes: Cisco TAC or upgrade procedures may remount filesystems or edit service scripts, so confirm against the change ticket. File timestamps may be forged by --reference timestomping [S4].

Scope

Affected

• Cisco Catalyst SD-WAN Controller and Manager components vulnerable to CVE-2026-20127 [S4][S1]

Only if

• SD-WAN controller peering is reachable by the attacker

Not affected if

• The controller runs the February 2026 fixed release or later [S1]. A compromise before patching is still possible.

Fixed in: February 2026 Cisco update (specific version not stated in source) [S1]

Enumerate

• All SD-WAN controller, validator and manager instances, with versions and patch dates
• Exposure of controller peering and management interfaces to the internet or to untrusted networks
• Control-connection peering events from unexpected peers
• Data-plane keys and edge devices served by any controller with artifacts
• Outbound UDP from controllers to unknown destinations

Contain

• Restrict controller peering and management access to known peers and admin networks. Apply Cisco's SD-WAN hardening guide [S1].
• Before any reboot or reimage, preserve evidence: vdaemon process memory, /etc/sv/, /var/tmp/vdaemon.*, /tmp/system-vdaemon and shell history [S4]. A reboot loses the in-memory injection state, and this cannot be undone.
• Block outbound UDP from controllers to anything other than known infrastructure [S1].
• Apply the February 2026 Cisco update [S1]. Patching does not remove an existing implant.
• Keys already exfiltrated cannot be recalled. Plan their rotation (see Recover).

Eradicate

• Restore the trojanized /etc/sv/*/run scripts to vendor state [S4].
• Remove conf_sshd, rsshd, aaamgrd, libdssl.so, libcommon.so and /var/tmp/vdaemon.* [S4][S1].
• Prefer a reimage from known-good vendor media over in-place cleaning, since the injection runs in memory and timestamps are forged [S4]. This is an inference; the sources give no rebuild guidance.

Recover

• Before reconnecting a controller, validate that it runs the February 2026 release or later and that its run scripts are clean [S1][S4].
• Rotate data-plane keys and controller credentials, because LittleFilch steals keying material [S4][S1]. Rotation is an inference; the sources give no vendor rotation guidance.
• Afterwards, monitor for re-modification of /etc/sv/, /rootfs.rw remounts, new /var/tmp/vdaemon.bin files, controller UDP egress and the Talos SIDs [S4][S1].

Re-enter the loop when

• Talos or Cisco publishes network indicators (C2 IPs or domains) or new file hashes.
• Cisco publishes specific fixed version numbers or revises its advisory.
• Reporting extends the targeting beyond defense and policy, for example to finance.
• Talos or Cisco names further exploited Cisco products or CVEs tied to UAT-11473.
• An edge device served by a compromised controller shows anomalous behaviour.

Debrief

• Record when each controller was patched, and set that against the first exploitation evidence.
• Record whether key material was staged or exfiltrated, and when rotation completed.
• Gap: no specific fixed version number is stated, only the February 2026 update [S1].
• Gap: no network C2 indicators (IPs or domains) are given in the input.
• Gap: the start date of exploitation is not given.
• Gap: sources differ on what LittleFilch captures: data-plane keys [S4] versus decrypted control-plane messages [S1].

Detection coverage — checked automatically

Checked automatically 2026-10-31 15:30Z from public sources: 9 published, 18 nothing found, 0 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

vuln:CVE-2026-20127

cpe:"cpe:/a:cisco:catalyst_sd-wan_manager"

product:"Catalyst Sd-wan Manager"

host.services: (software.product = "Catalyst Sd-wan Manager")

product:"Cisco Catalyst SD-WAN vdaemon"

cpe:"cpe:/a:cisco:sd-wan_vbond_orchestrator"

product:"Sd-wan Vbond Orchestrator"

host.services: (software.product = "Sd-wan Vbond Orchestrator")

cpe:"cpe:/a:cisco:sd-wan_vsmart_controller"

product:"Sd-wan Vsmart Controller"

host.services: (software.product = "Sd-wan Vsmart Controller")

http.title:"vManage"

http.html:"Cisco vManage"

Internet-wide count, trend

Shodan's count of matching services on the whole internet, one point a day; the scope (your ranges) is never part of it. A count moves with Shodan's crawl as much as with patching, so read the direction, not the digit.

Banner spellings: a model read 7 from the NVD names and this card's text (former and marketing names, console titles); 2 matched something on Shodan and are shown above, the rest were dropped.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-10-31 15:30Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• What is the specific fixed version number for each controller release train?
• Does LittleFilch steal data-plane keys, control-plane material, or both? Sources describe it differently [S4][S1].
• When did exploitation begin, and was CVE-2026-20127 exploited as a zero-day before February 2026?
• How strong is the Silent Train overlap with Volt Typhoon [S3]? Is it an attribution or only shared infrastructure?
• The only_if condition (controller peering reachable by the attacker) is carried from v1 and is not stated in today's sources. Analyst should confirm.

Sources

• [S1] https://www.bleepingcomputer.com/news/security/hackers-exploit-cisco-sd-wan-flaw-to-deploy-custom-keydrift-malware/ · BleepingComputer
• [S2] https://thehackernews.com/2026/10/hackers-exploited-cisco-sd-wan-flaw-to.html · The Hacker News
• [S3] https://www.securityweek.com/cisco-sd-wan-zero-day-exploitation-tied-to-volt-typhoons-silent-train-network/ · SecurityWeek
• [S4] https://blog.talosintelligence.com/uat-11473-keydrift/ · Cisco Talos Blog

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically once it crosses the publish bar.