If you run Cisco Catalyst SD-WAN, patch and hunt.
What’s going on
Cisco Talos says a new group it tracks as UAT-11473 is exploiting CVE-2026-20127, a max-severity authentication bypass in Catalyst SD-WAN Controller and Manager that Cisco patched in February. It lets attackers gain privileged access and add rogue peers. The group deploys KeyDrift, a custom framework that lives inside SD-WAN control-plane processes. Its PolyFlame piece runs in legitimate vdaemon processes and supports commands and file transfers. Its LittleFilch piece hooks SSL_read to read decrypted control traffic and pull what Talos believes is AES-256 IPsec data-plane key material. Targets include space and satellite services, defense and aerospace, and policy research groups. Talos sees overlap with Volt Typhoon’s Silent Train network, which I covered earlier, but made no firm link.
My take
Patch to a fixed release, keep management interfaces off the internet, review the peer list for anything you didn’t add, and check Talos’s indicators. If you find it, assume your IPsec keys are burned and rotate them.
God Bless, and Needs Garlic!
