Changed since version 3

• Renumbered sources: Talos is now S4 (was S1) and SecurityWeek is now S3 (was S2). Added BleepingComputer [S1] and The Hacker News [S2].
• fixed_in changed from null to the February 2026 Cisco update, with no specific version stated [S1].
• not_affected_if now names the February 2026 fixed release or later [S1].
• Contain and verdict now include Cisco's SD-WAN hardening guide [S1].
• Added the reported defense and policy targeting to what_happened and triage [S1][S2]. The debrief gap on targeted sectors is narrowed to verifying this against the primary source.
• The debrief gap on the fix version is narrowed: an update month is stated, a version number is not [S1].
• Added UDP exfiltration of RSA-encrypted staged data as corroborated by [S1].

What happened

• UAT-11473 exploited CVE-2026-20127, a CVSS 10 authentication bypass in Cisco Catalyst SD-WAN Controllers, to deploy the KeyDrift framework [S4][S1].
• Trojanized runit scripts remount /rootfs.rw and launch conf_sshd. The rsshd ptrace injector then loads PolyFlame (libdssl.so) into vdaemon, and a packed aaamgrd runs under /etc/sv/aaamgr/ [S4].
• LittleFilch (libcommon.so) hooks SSL_read in vdaemon to read decrypted control-plane messages. It RSA-encrypts the keying material, stages it in /var/tmp/vdaemon.bin, and sends it out over UDP [S4][S1].
• SecurityWeek reports that the KeyDrift infrastructure overlaps with Volt Typhoon's Silent Train network [S3].
• Reporting describes the targets as defense and policy organisations [S1][S2].
• Cisco recommends its February 2026 update and its SD-WAN hardening guide [S1].

Timeline

Detect

KeyDrift file and process artifacts · SD-WAN controller file integrity monitoring / process execution logs

index=* ("/var/tmp/vdaemon.bin" OR "/var/tmp/vdaemon.conf" OR "/tmp/system-vdaemon" OR "libdssl.so" OR "libcommon.so" OR "rsshd" OR "conf_sshd" OR "aaamgrd") | stats count min(_time) as first max(_time) as last by host, source

FROM logs-* | WHERE file.path IN ("/var/tmp/vdaemon.bin", "/var/tmp/vdaemon.conf", "/tmp/system-vdaemon") OR file.name IN ("libdssl.so", "libcommon.so") OR process.name IN ("rsshd", "conf_sshd", "aaamgrd") OR process.command_line LIKE "*/var/tmp/vdaemon.bin*" OR process.command_line LIKE "*/var/tmp/vdaemon.conf*" OR process.command_line LIKE "*/tmp/system-vdaemon*" OR process.command_line LIKE "*libdssl.so*" OR process.command_line LIKE "*libcommon.so*" OR process.command_line LIKE "*rsshd*" OR process.command_line LIKE "*conf_sshd*" OR process.command_line LIKE "*aaamgrd*" | STATS count = COUNT(*), first = MIN(@timestamp), last = MAX(@timestamp) BY host.name, event.dataset

A hit means: A KeyDrift component or its key staging file is present on a controller [S4]. Treat it as probable compromise with possible key theft.

Staging and timestomping commands · Controller shell history / auditd execve

index=* (("rootfs.rw" ("remount" OR "mount")) OR "touch --reference=" OR "chmod --reference=") | table _time host user _raw

FROM logs-* | WHERE (process.command_line LIKE "*rootfs.rw*" AND process.command_line LIKE "*mount*") OR process.command_line LIKE "*touch --reference=*" OR process.command_line LIKE "*chmod --reference=*" | KEEP @timestamp, host.name, user.name, process.command_line

A hit means: Someone remounted the read-only root or copied file metadata, as UAT-11473 did [S4]. Check the hit against change records, and inspect any /etc/sv/ files it touched.

vdaemon spawning a shell · Controller process execution / auditd

index=* parent_process_name="vdaemon" (process_name="sh" OR "/bin/sh -c") | table _time host parent_process_name process _raw

FROM logs-* | WHERE process.parent.name == "vdaemon" AND (process.name == "sh" OR process.command_line LIKE "*/bin/sh -c*") | KEEP @timestamp, host.name, process.parent.name, process.executable, process.command_line

A hit means: vdaemon ran a shell command. This matches the implant's 0x100 command-execution function [S4].

Talos Snort SIDs: exploitation and KeyDrift artifacts · Network IPS alerts

index=* signature_id=* | eval sid=tonumber(signature_id) | where sid=65938 OR sid=65958 OR (sid>=67387 AND sid<=67416) | stats count min(_time) as first max(_time) as last by src, dest, signature_id

FROM logs-* | WHERE rule.id IS NOT NULL | EVAL sid = TO_INTEGER(rule.id) | WHERE sid == 65938 OR sid == 65958 OR (sid >= 67387 AND sid <= 67416) | STATS count = COUNT(*), first = MIN(@timestamp), last = MAX(@timestamp) BY source.ip, destination.ip, rule.id

A hit means: Traffic matched Talos signatures [S4]. SIDs 65938 and 65958 indicate CVE-2026-20127 exploitation. SIDs 67387-67416 (Snort v2) indicate KeyDrift artifacts; Snort v3 sensors use 7:44-7:73 instead. Check the controller for on-box artifacts.

Verify

• Inspect /etc/sv/*/run scripts on each controller, especially /etc/sv/sshd/run, for added mount, conf_sshd or background-launch lines [S4].
• The legitimate aaamgr is a Python package. A compiled ELF aaamgrd under /etc/sv/aaamgr/ is anomalous [S4].
• Check vdaemon process memory maps for injected libdssl.so or libcommon.so [S4].
• Look for /var/tmp/vdaemon.bin and /var/tmp/vdaemon.conf, and for outbound UDP from the controller [S4][S1].
• Benign look-alikes: TAC or upgrade work may remount filesystems or edit service scripts, so confirm against the change ticket. File timestamps can be forged with --reference, so do not trust mtime alone [S4].

Scope

Affected

• Cisco Catalyst SD-WAN Controllers vulnerable to CVE-2026-20127 [S4][S1]

Only if

• The attacker can reach SD-WAN controller peering [S4]

Not affected if

• The controller runs Cisco's February 2026 fixed release or later [S1]. A compromise from before patching is still possible [S4].

Fixed in: February 2026 Cisco update; the sources state no specific version [S1]

Enumerate

• All SD-WAN controller, validator and manager instances, with versions and patch dates
• Exposure of controller peering and management interfaces to the internet or untrusted networks
• Control-connection peering events from unexpected peers
• Data-plane keys and edge devices served by any controller with artifacts
• Outbound UDP from controllers to unknown destinations

Contain

• Restrict controller peering and management access to known peers and admin networks. This is an inference from the reachability condition, not source guidance.
• Before any reboot or reimage, preserve evidence: vdaemon process memory, /etc/sv/, /var/tmp/vdaemon.*, /tmp/system-vdaemon and shell history [S4]. A reboot loses the in-memory injection state, and this cannot be undone.
• Block outbound UDP from controllers except to known infrastructure, because staged data leaves over UDP [S4][S1].
• Apply Cisco's February 2026 update and the Cisco SD-WAN hardening guide [S1]. Patching does not remove an existing implant [S4].
• Keys already exfiltrated cannot be recalled. Plan their rotation (see Recover).

Eradicate

• Restore trojanized /etc/sv/*/run scripts, and remove conf_sshd, rsshd, ELF aaamgrd, libdssl.so, libcommon.so and the /var/tmp/vdaemon.* files [S4].
• Restart or rebuild vdaemon only after evidence capture, so the injected PolyFlame and LittleFilch modules are gone [S4].
• Close the root cause by running the February 2026 fixed release [S1].

Recover

• Before reconnecting a controller, confirm it runs the February 2026 fix or later [S1] and that its run scripts are clean [S4].
• Rotate data-plane keys and controller credentials, because LittleFilch steals keying material [S4]. Rotation is an inference; the sources give no rotation guidance.
• Afterwards, monitor for re-modification of /etc/sv/, /rootfs.rw remounts, new /var/tmp/vdaemon.bin files, vdaemon shell spawns, controller UDP egress and the Talos SIDs [S4].

Re-enter the loop when

• Cisco publishes specific fixed version numbers, or changes its advisory for CVE-2026-20127.
• Talos or another source publishes network C2 indicators or UDP exfiltration destinations.
• Reporting adds the SD-WAN Manager or another product to the exploited set.
• A hunt hit appears on a controller that was already patched.
• New reporting widens the targeting beyond defense and policy organisations.

Debrief

• Record when each controller was patched, and set that against the first exploitation evidence.
• Record whether key material was staged or exfiltrated, and when rotation completed.
• Gap: the sources say the fix shipped in the February 2026 update but give no version number [S1].
• Gap: the sources give no network C2 indicators.
• Gap: the sources give no exploitation start date.
• Gap: the defense and policy targeting comes from secondary reporting [S1][S2]; the primary source still needs to be checked for it.

Detection coverage — checked automatically

Checked automatically 2026-11-10 05:36Z from public sources: 9 published, 18 nothing found, 0 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

Where each CVE comes from: CVE-2026-20127 — UAT-11473 exploits Cisco SD-WAN CVE-2026-20127 to deploy KeyDrift malware against defense and policy targets. A product row answers "is the software from that story reachable from the internet", not "is this card about that software".

vuln:CVE-2026-20127

cpe:"cpe:/a:cisco:catalyst_sd-wan_manager"

product:"Catalyst Sd-wan Manager"

host.services: (software.product = "Catalyst Sd-wan Manager")

product:"Cisco Catalyst SD-WAN vdaemon"

cpe:"cpe:/a:cisco:sd-wan_vbond_orchestrator"

product:"Sd-wan Vbond Orchestrator"

host.services: (software.product = "Sd-wan Vbond Orchestrator")

cpe:"cpe:/a:cisco:sd-wan_vsmart_controller"

product:"Sd-wan Vsmart Controller"

host.services: (software.product = "Sd-wan Vsmart Controller")

http.title:"vManage"

http.html:"Cisco vManage"

http.html:"Cisco SD-WAN vSmart"

Internet-wide count, trend

Shodan's count of matching services on the whole internet, one point a day; the scope (your ranges) is never part of it. A count moves with Shodan's crawl as much as with patching, so read the direction, not the digit.

Banner spellings: a model read 7 from the NVD names and this card's text (former and marketing names, console titles); 3 matched something on Shodan and are shown above, the rest were dropped.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-10 05:36Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• What is the exact fixed version for each SD-WAN release train? The sources say only 'February 2026 update' [S1].
• Is the Catalyst SD-WAN Manager also affected? The pipeline exposure data lists it, but the sources cited here name only Controllers.
• Does Talos state the defense and policy targeting, or does it come only from secondary reporting [S1][S2]?
• The Silent Train overlap is reported as an infrastructure overlap [S3]. Is it an attribution to Volt Typhoon?
• The brief context mentions a public PoC repo. No source in hand describes it.

Sources

• [S1] https://www.bleepingcomputer.com/news/security/hackers-exploit-cisco-sd-wan-flaw-to-deploy-custom-keydrift-malware/ · BleepingComputer
• [S2] https://thehackernews.com/2026/10/hackers-exploited-cisco-sd-wan-flaw-to.html · The Hacker News
• [S3] https://www.securityweek.com/cisco-sd-wan-zero-day-exploitation-tied-to-volt-typhoons-silent-train-network/ · SecurityWeek
• [S4] https://blog.talosintelligence.com/uat-11473-keydrift/ · Cisco Talos Blog

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically; a dismissed draft unpublishes it.