Search — “rsshd”

Cisco Talos reports APT UAT-11473 exploited CVE-2026-20127 (CVSS 10 auth bypass) in Cisco Catalyst SD-WAN controllers and installed the KeyDrift framework, whose infrastructure overlaps with Volt Typhoon's Silent Train network. Trojanized runit scripts remount /rootfs.rw executable and launch conf_sshd, which enumerates vdaemon PIDs and uses the rsshd ptrace injector to load PolyFlame (libdssl.so); a packed aaamgrd variant runs under /etc/sv/aaamgr/. LittleFilch (libcommon.so) hooks SSL_read in vdaemon to steal data-plane keys and stages them in /var/tmp/vdaemon.bin. Hunt for modified /etc/sv/*/run scripts, the listed file artifacts, ELF aaamgrd, and touch/chmod --reference timestomping.