Search — “CVE-2026-20127”

Cisco Talos reports a newly identified cluster tracked as UAT-11473 exploiting CVE-2026-20127, an authentication bypass in Cisco Catalyst SD-WAN Controllers, to deploy the custom KeyDrift framework. The sources say KeyDrift runs inside vdaemon processes, intercepts decrypted control-plane traffic via SSL_read hooking, and stages keying material in /var/tmp/vdaemon.bin before UDP exfiltration. Hunters should look for activity in vdaemon processes, modified service startup scripts, and creation of /var/tmp/vdaemon.bin; Cisco recommends the February 2026 update and its SD-WAN hardening guide.

Cisco Talos reports APT UAT-11473 exploited CVE-2026-20127 (CVSS 10 auth bypass) in Cisco Catalyst SD-WAN controllers and installed the KeyDrift framework, whose infrastructure overlaps with Volt Typhoon's Silent Train network. Trojanized runit scripts remount /rootfs.rw executable and launch conf_sshd, which enumerates vdaemon PIDs and uses the rsshd ptrace injector to load PolyFlame (libdssl.so); a packed aaamgrd variant runs under /etc/sv/aaamgr/. LittleFilch (libcommon.so) hooks SSL_read in vdaemon to steal data-plane keys and stages them in /var/tmp/vdaemon.bin. Hunt for modified /etc/sv/*/run scripts, the listed file artifacts, ELF aaamgrd, and touch/chmod --reference timestomping.

Black Lotus Labs reports that China-nexus Volt Typhoon has used the Silent Train framework, a rotating chain of compromised SOHO/IoT and enterprise devices, to route and hide operations, with at least four zero-day vulnerabilities exploited against edge and management products. Sources list VeloCloudOrchestrator, Cisco Catalyst SD-WAN, N-able N-central, Versa Director, and Quest KACE (suspected). Hunters should look for chained SSH sessions through relay devices, temporary SSH services and keys created then removed on relays, and unusual administrative activity on centralized management systems.