Search — “/var/tmp/vdaemon.bin”

Cisco Talos reports a newly identified cluster tracked as UAT-11473 exploiting CVE-2026-20127, an authentication bypass in Cisco Catalyst SD-WAN Controllers, to deploy the custom KeyDrift framework. The sources say KeyDrift runs inside vdaemon processes, intercepts decrypted control-plane traffic via SSL_read hooking, and stages keying material in /var/tmp/vdaemon.bin before UDP exfiltration. Hunters should look for activity in vdaemon processes, modified service startup scripts, and creation of /var/tmp/vdaemon.bin; Cisco recommends the February 2026 update and its SD-WAN hardening guide.

Cisco Talos reports APT UAT-11473 exploited CVE-2026-20127 (CVSS 10 auth bypass) in Cisco Catalyst SD-WAN controllers and installed the KeyDrift framework, whose infrastructure overlaps with Volt Typhoon's Silent Train network. Trojanized runit scripts remount /rootfs.rw executable and launch conf_sshd, which enumerates vdaemon PIDs and uses the rsshd ptrace injector to load PolyFlame (libdssl.so); a packed aaamgrd variant runs under /etc/sv/aaamgr/. LittleFilch (libcommon.so) hooks SSL_read in vdaemon to steal data-plane keys and stages them in /var/tmp/vdaemon.bin. Hunt for modified /etc/sv/*/run scripts, the listed file artifacts, ELF aaamgrd, and touch/chmod --reference timestomping.