Threat Overview
Cisco Talos published a new technical analysis on October 28, 2026 of UAT-11473 exploiting an authentication bypass in Cisco Catalyst SD-WAN control-plane components. The actor deployed KeyDrift, a purpose-built framework for persistence, in-process interception of controller traffic, and collection of sensitive keying material. PolyFlame uses modified runit service launchers, injects libdssl.so into vdaemon, and supports in-band tasking; LittleFilch hooks SSL_read and stages assessed data-plane keys. Cisco confirms limited exploitation, while Talos describes the recovered malware and historical activity. The exploit is not simply an HTTP shell: ordinary network beacon hunting may miss command traffic inside SD-WAN control channels.
References
Cisco Talos — Inside KeyDrift, 2026-10-28
Cisco PSIRT — CVE-2026-20127, updated 2026-10-28
Impacted Systems
Cisco Catalyst SD-WAN Controller (formerly vSmart), Manager (vManage), and Validator (vBond); on-premises and Cisco-hosted/cloud-managed/FedRAMP deployment types. Vulnerability applies regardless of device configuration. First fixed releases: 20.9.8.2 (20.9), 20.12.5.3 or 20.12.6.1 (20.12), 20.15.4.2 (20.15), and 20.18.2.1 (20.18); other/EOL trains must migrate per Cisco advisory. Affected services include controller peering and management; internet-reachable controllers or management services increase exposure. Cisco has not identified unrelated Cisco products as affected.
Why this matters
A compromise of the SD-WAN control plane can expose intersite key material, change fabric configuration, and sustain covert access across many locations. Cisco-specific authentication, peering and runit artifacts offer higher fidelity than generic outbound C2 hunts.
Exploitation Status
Confirmed exploitation: Cisco PSIRT acknowledges limited exploitation (advisory updated October 28); Cisco Talos analyzed historical UAT-11473 deployments. Talos assesses high-confidence infrastructure overlap with Volt Typhoon Silent Train, which is not proof that the actor is Volt Typhoon.
What this hunt looks for
The layered hunts below cover: Cisco SD-WAN privileged vmanage-admin SSH authentication; Cisco SD-WAN unexpected vmanage peering events; KeyDrift named artifact references in appliance logs; KeyDrift runit persistence and executable overlay behavior; KeyDrift process injection or vdaemon manipulation logs; Cisco Snort CVE and KeyDrift signature matches; New sources reaching SD-WAN control management ports; Cisco SD-WAN repeated peering state transitions.
Required logs
Depending on the hunt: CommonSecurityLog, Syslog. Only ingested Sentinel tables can be searched; appliance-specific logs must be forwarded and parsed to be visible.
Hunt 01: Cisco SD-WAN privileged vmanage-admin SSH authentication
Required: Syslog. High signal only when Cisco controller auth.log is forwarded into Sentinel. Validate source IP against approved controller System IPs.
Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_all ('Accepted', 'publickey', 'vmanage-admin')
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated descHunt 02: Cisco SD-WAN unexpected vmanage peering events
Required: Syslog. Cisco notes that vmanage peering must be compared with authorized peer inventory; no unauthorised classification without it.
Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has 'control-connection-state-change'
| where SyslogMessage has 'peer-type:vmanage'
| extend PeerIP = extract(@'public-ip:([^ ]+)',1,SyslogMessage), PeerSystemIP = extract(@'peer-system-ip:([^ ]+)',1,SyslogMessage)
| summarize Events=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Messages=make_set(SyslogMessage,3) by Computer, PeerIP, PeerSystemIP
| order by Events descHunt 03: KeyDrift named artifact references in appliance logs
Required: Syslog. Exact artifacts were published by Cisco Talos. No hit is expected unless appliance logs capture these paths; absence is not exculpatory.
let artifacts = dynamic(['conf_sshd','rsshd','libdssl.so','libcommon.so','/tmp/system-vdaemon','/var/tmp/vdaemon.bin','/var/tmp/vdaemon.conf']);
Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any (artifacts)
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated descHunt 04: KeyDrift runit persistence and executable overlay behavior
Required: Syslog. Investigate only on confirmed SD-WAN control-plane hosts; generic service messages can be normal.
Syslog
| where TimeGenerated >= ago(30d)
| where (SyslogMessage has '/rootfs.rw' and SyslogMessage has_any ('remount','exec'))
or (SyslogMessage has '/etc/sv/' and SyslogMessage has_any ('sshd','aaamgr','run'))
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated descHunt 05: KeyDrift process injection or vdaemon manipulation logs
Required: Syslog. Talos described ptrace injection into vdaemon. Normal Syslog rarely records ptrace; endpoint/audit instrumentation is required for stronger visibility.
Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has 'vdaemon'
| where SyslogMessage has_any ('ptrace','inject','mprotect','rsshd','libdssl','segfault')
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated descHunt 06: Cisco Snort CVE and KeyDrift signature matches
Required: CommonSecurityLog. Only meaningful if matching Snort signature events are forwarded and retain the rule ID. Snort v3 IDs 7:44–7:73 may be encoded differently.
let sids = dynamic(['65938','65958','67387','67388','67389','67390','67391','67392','67393','67394','67395','67396','67397','67398','67399','67400','67401','67402','67403','67404','67405','67406','67407','67408','67409','67410','67411','67412','67413','67414','67415','67416']);
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where tostring(DeviceEventClassID) in (sids)
or (Message has_any ('65938','65958','KeyDrift','PolyFlame','LittleFilch'))
| project TimeGenerated, DeviceVendor, DeviceProduct, DeviceEventClassID, SourceIP, DestinationIP, DeviceAction, Message
| order by TimeGenerated descHunt 07: New sources reaching SD-WAN control management ports
Required: CommonSecurityLog. Requires an approved list of controller destination IPs to reduce noise; this generic management-port query does not prove SD-WAN targeting.
let baseline = CommonSecurityLog
| where TimeGenerated between (ago(30d)..ago(2d))
| where DestinationPort in (22,830)
| summarize by SourceIP, DestinationIP, DestinationPort;
CommonSecurityLog
| where TimeGenerated >= ago(2d)
| where DestinationPort in (22,830)
| where isnotempty(SourceIP) and isnotempty(DestinationIP)
| join kind=leftanti baseline on SourceIP, DestinationIP, DestinationPort
| summarize Connections=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort
| order by Connections descHunt 08: Cisco SD-WAN repeated peering state transitions
Required: Syslog. High churn can be a maintenance or connectivity problem; correlate with unapproved peers and management authentication.
Syslog
| where TimeGenerated >= ago(14d)
| where SyslogMessage has 'control-connection-state-change'
| extend PeerIP=extract(@'public-ip:([^ ]+)',1,SyslogMessage)
| summarize StateChanges=count(), Samples=make_set(SyslogMessage,3) by Computer, PeerIP, bin(TimeGenerated,1h)
| where StateChanges >= 5
| order by StateChanges descDetection Notes
Highest signal: vmanage-admin SSH accepted from unauthorized IPs, unexpected controller peering, exact KeyDrift artifact names and Cisco Snort rule hits. Lower signal: new management-port sources and high peering churn. Talos found no hardcoded C2 IPs/domains in PolyFlame. In-band encrypted control traffic and process-memory injection are often invisible to generic network flow logs. Syslog must include controller auth/peering/service events; Cisco-specific file paths are not necessarily logged. The CommonSecurityLog queries require CEF/IDS data with relevant fields; no generic Cisco inventory guarantees Snort SIDs.
This is a detection reference, not a claim that a customer workspace was queried. Missing Sentinel telemetry and retention can conceal activity.
