[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fuTm-VfuUQlVE3BJ17UbO424rZNrz8XlH6egQWH0NKaM":3},{"article":4,"iocs":57,"watch_terms":71,"solutions":72,"lesson":168},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"dd264d65-4988-49b1-956a-ddde17668006","Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware","hackers-exploit-cisco-sd-wan-flaw-to-deploy-custom-keydrift-malware-45dcc2","A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift. [...]","An advanced persistent threat group tracked as UAT-11473 exploited CVE-2026-20127, a maximum-severity authentication-bypass vulnerability in Cisco Catalyst SD-WAN Controllers patched in February 2026, to deploy a custom malware framework called KeyDrift. The KeyDrift framework is designed to maintain persistent access, intercept encrypted control-plane traffic, and extract cryptographic keying material from SD-WAN controllers. The attacks targeted space, satellite, defense, aerospace, and policy research organizations, with researchers noting possible overlap between UAT-11473 and the Chinese state-sponsored Volt Typhoon group's \"Silent Train\" covert network.","APT group UAT-11473 exploits Cisco SD-WAN auth-bypass flaw to deploy KeyDrift malware.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-exploit-cisco-sd-wan-flaw-to-deploy-custom-keydrift-malware\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F10\u002F14\u002FCisco.jpg","2026-10-29T18:38:26+00:00","2026-10-29T19:00:19.602295+00:00",9,[17,20,22,25,28],{"name":18,"type":19},"UAT-11473","threat_actor",{"name":21,"type":19},"Volt Typhoon",{"name":23,"type":24},"Silent Train","campaign",{"name":26,"type":27},"Cisco Catalyst SD-WAN Controller","product",{"name":29,"type":30},"Cisco","vendor","574f766a-fb3f-487c-8d2c-0720ae75471b",{"id":31,"icon":33,"name":34,"slug":35},null,"Zero-day","zero-day",[37,42,47,52],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":53},{"id":54,"icon":33,"name":55,"slug":56},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[58,62,65,68],{"type":59,"value":60,"context":61},"cve","CVE-2026-20127","Max-severity authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, exploited by UAT-11473 to deploy KeyDrift malware",{"type":51,"value":63,"context":64},"KeyDrift","Custom malware framework deployed on Cisco SD-WAN controller instances; designed for persistent access and cryptographic key extraction",{"type":51,"value":66,"context":67},"PolyFlame","Primary component of KeyDrift malware; runs in vdaemon processes, supports command execution and C2 relay",{"type":51,"value":69,"context":70},"LittleFilch","Control-session interception module of KeyDrift; hooks SSL_read to extract AES-256 IPsec data-plane key material",[29,26],{"controls":73,"vendors":161},[74,103,132],{"slug":75,"name":76,"problem":77,"products":78},"patch-management","Automated patch management","Known holes get closed in days, not months.",[79,87,95],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":104,"name":105,"problem":106,"products":107},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[108,116,124],{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"slug":133,"name":134,"problem":135,"products":136},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[137,145,153],{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":154,"vendor_name":155,"vendor_logo":156,"product_slug":157,"product_name":158,"url":159,"description":160},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",[162],{"slug":163,"name":29,"logo_path":164,"roles":165},"cisco","\u002Fvendor-logos\u002Fcisco.png",[166,167],"affected","reported_by",{"slug":169,"title":170,"body":171,"framework_refs":172,"framework_notes":180},"unpatched-cisco-sd-wan-flaw-enables-state-sponsored-keydrift-malware-campaign","Unpatched Cisco SD-WAN Flaw Enables State-Sponsored KeyDrift Malware Campaign","A maximum-severity authentication-bypass vulnerability in Cisco Catalyst SD-WAN Controllers (CVE-2026-20127) was exploited by an advanced persistent threat group to deploy the custom KeyDrift malware framework, targeting critical defense, aerospace, and policy organizations. Despite a patch being available since February 2026, the vulnerability remained unaddressed in victim environments long enough for attackers to establish persistent access and intercept encrypted control-plane traffic. This incident underscores the extreme risk of delayed patching on internet-facing network infrastructure, particularly when the vulnerability carries a maximum severity rating. The ability of KeyDrift to extract cryptographic keying material from SD-WAN controllers represents a catastrophic confidentiality failure, potentially compromising all traffic protected by those keys. Organizations supporting national security or critical infrastructure sectors face an elevated threat from state-sponsored actors who actively monitor public vulnerability disclosures and weaponize them rapidly.",[173,174,175,176,177,178,179],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","MITRE ATT&CK T1190: Exploit Public-Facing Application",{"NIS2 Article 21(2)(b)":181,"NIST SP 800-53 SI-2: Flaw Remediation":182,"OWASP A06:2021 Vulnerable and Outdated Components":183,"CIS Control 7: Continuous Vulnerability Management":184,"MITRE ATT&CK T1190: Exploit Public-Facing Application":185,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":186,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":187},"NIS2 mandates incident handling and vulnerability management practices for operators of essential services; defense and aerospace organizations in scope must maintain patching disciplines that would have prevented this authentication-bypass exploitation.","SI-2 requires organizations to identify, report, and correct information system flaws within organizationally defined timeframes — a rigorous implementation would have mandated emergency patching of CVE-2026-20127 immediately upon disclosure.","The SD-WAN controllers were running software with a known critical vulnerability, perfectly matching the A06 category of failing to update or patch components in a timely manner, resulting in a successful compromise.","A maximum-severity patch had been available for weeks before exploitation; a mature vulnerability management program with mandatory remediation timelines for critical CVEs would have closed this window before attackers could act.","UAT-11473 exploited a publicly disclosed vulnerability in an internet-facing Cisco SD-WAN controller, directly matching this technique, and detection analytics mapped to T1190 would have flagged the anomalous authentication bypass activity at the point of initial access.","This control explicitly requires timely identification and remediation of technical vulnerabilities in information systems — direct application to the failure to patch a publicly disclosed, maximum-severity Cisco flaw before it was weaponized.","The root vulnerability was an authentication bypass, meaning controls around verifying identity on the SD-WAN control plane were ineffective; PR.AA calls for robust authentication mechanisms that would have reduced the exploitability of this flaw."]