DEV Community

Anoymask
Anoymask

Posted on

KeyDrift: UAT-11473's Cisco SD-WAN Implants and IPsec Key-Extraction Capabilities

#security #threatintel

1. Basic Information

2. Executive Summary

Cisco Talos reported active exploitation of CVE-2026-20127 by UAT-11473 and the deployment of the KeyDrift family. Analysis identified command execution and data-extraction/transmission capabilities. Talos assessed with high confidence that the targeted data represents AES-256 IPsec data-plane key material; this does not establish successful exfiltration in every compromised environment.

The authentication bypass, rated CVSS v3.1 10.0, has seen limited active exploitation, and the deployed implants provide management-plane operations and key-extraction capabilities. The actual use scope of the extracted keys remains unconfirmed.

3. Attack Flow

Initial Access and Deployment (Full Privilege Acquisition Path Not Publicly Documented)

  1. The attacker bypasses authentication using CVE-2026-20127. The vulnerability alone grants access as a high-privileged internal non-root user, allowing fabric configuration changes via NETCONF.
  2. In one deployment vector observed by Talos, conf_sshd and rsshd are invoked from the runit sshd configuration, and PolyFlame (libdssl.so) is injected into vdaemon via ptrace.
  3. In another vector, a packed loader disguised as aaamgrd is used along with the runit /etc/sv/aaamgr/ directory. This vector was observed on Validators (vBond) and is not a subsequent stage of the sshd vector.

Capabilities Confirmed in LittleFilch Analysis

  1. Hooks SSL_read within vdaemon on the Controller (vSmart) to extract a 32-byte field assessed by Talos with high confidence to be the AES-256 IPsec data-plane key.
  2. LittleFilch can encrypt the collected material using RSA, save it to /var/tmp/vdaemon.bin, and send it over UDP. The vdaemon.conf file specifying transmission endpoints is deleted after being read and was not recovered by Talos. The analyzed capability does not establish successful transmission or subsequent traffic decryption across all compromised environments.

4. Attacker Positioning and Execution Location

  • Authentication is bypassed from a position with reachability to vulnerable SD-WAN management and control planes, and some deployed implants execute inside vdaemon. Internet exposure is not required.

5. Visibility for Victims and Administrators

Victims

  • General users may experience no obvious display changes.

Administrators

  • Appears as vmanage-admin logins from unknown IPs, vdaemon anomalies, /var/tmp artifacts, and UDP transmissions.

6. Success and Failure Conditions

Success Conditions

  • Reachability to the management plane of a vulnerable release.
  • Injection of the implant into vdaemon.
  • Privileges and execution paths capable of deploying and injecting the implant following the authentication bypass. The source materials do not describe the full path from non-root access to the privileges needed for implant deployment and injection.

Failure Conditions and Mitigations

  • Apply the appropriate Cisco fixed release for the affected version branch and restrict access to the management plane. Examples include release 20.9.8.2 for the 20.9 branch, 20.15.4.2 for the 20.15 branch, and 20.18.2.1 for the 20.18 branch. Check the official advisory for other branches.
  • Restrict SSH (port 22) and NETCONF (port 830) to known controllers and operationally required hosts. Authentication-log, peer-event, and Snort SID monitoring are detection controls; monitoring alone does not prevent initial compromise.

7. Impact of Successful Exploitation

  • Arbitrary command and file operations on the SD-WAN management plane by the deployed implant.
  • Talos analysis confirmed the capability to extract and transmit information assessed as IPsec keys. Subsequent use of the keys or decryption of traffic has not been confirmed.

8. Observable Logs

Inference: The following are potential log sources to check within your organization. Availability depends on log collection and retention settings and product visibility, and primary sources do not guarantee all items were recorded in every case.

  • Email: None applicable
  • Proxy / SWG / DNS: None applicable
  • Endpoint / EDR: Check for vdaemon/aaamgrd process maps, ptrace activity, runit paths, and /var/tmp artifacts.
  • Identity / IdP: None applicable
  • SaaS / Cloud: None applicable
  • Network: Check for SSH/NETCONF access, peer events, and unknown UDP transmissions.

9. Compromise Determination

Inference: The following criteria are for internal assessment and do not imply that source materials observed every compromise phase.

  • Attack Attempt Observed (Success Unconfirmed): Criteria: Reconnaissance or probing observed, but compromise is unconfirmed. Target: Management plane
  • Malware Execution or Successful Authentication Confirmed: Criteria: Unauthorized login or KeyDrift execution confirmed. Target: SD-WAN Manager
  • Data Theft or Session Compromise Confirmed: Criteria: Evidence of cryptographic key material extraction. Target: IPsec data plane

10. Investigation Playbook

Inference: Recommended internal investigation procedures.

  • Trigger: Unknown vmanage-admin logins, KeyDrift artifacts, Talos/Cisco signatures
  • Initial Checks: Verify product version, exposure scope, time synchronization, and log retention.
  • Endpoint: Preserve device configurations, processes, files, and reboot history.
  • Identity and Cloud: Review administrator authentication and API activities.
  • Follow-on Activity: Track subsequent internal connections, credential usage, configuration changes, and outbound traffic.
  • Containment: Preserve evidence and follow Cisco/TAC procedures to restrict the management plane, apply patches, and recover from a known good state. Plan credential and key rotations based on the scope of compromise and communication impact.
  • Assessment Categories: Record attempts, initial execution, successful authentication, data theft, and subsequent compromise separately.

11. Defense and Detection Ideas

  • Single Events: Detect vdaemon injection and the creation of /var/tmp/vdaemon.bin.
  • Timeline Correlation: Correlate logins, service modifications, injections, and UDP transmissions.
  • Hunting: Inspect vdaemon process maps, runit directories, /var/tmp, and authorized keys.
  • Logging Gaps: Network appliances may not support EDR agents.
  • Priority Controls: Apply patches, isolate the management plane, ensure log retention, and rotate keys.

12. Facts / Inference / Hypothesis

Facts

  • Talos confirmed UAT-11473 exploitation of CVE-2026-20127 and the deployment of KeyDrift components. According to Cisco, the authentication bypass grants access as a high-privileged internal non-root user, allowing fabric configuration changes via NETCONF. The vulnerability alone does not grant root privileges.
  • PolyFlame is injected into the legitimate vdaemon process, providing file read/write capabilities, command execution via /bin/sh -c, and relay-style C2 functionality.
  • LittleFilch hooks SSL_read within vdaemon on the Controller (vSmart) and extracts a 32-byte field that Talos assessed with high confidence to be AES-256 IPsec data-plane key material. It can encrypt the collected material using RSA, save it to /var/tmp/vdaemon.bin, and send it over UDP. Its vdaemon.conf endpoint configuration is deleted after reading and was not recovered by Talos. This is a description of analyzed functionality, not confirmation of successful exfiltration or subsequent traffic decryption across all victims.
  • rsshd acts as a ptrace injector and, alongside conf_sshd, injects PolyFlame into vdaemon. Another deployment vector observed on Validators involves the runit aaamgr service and a packed loader disguised as aaamgrd.
  • Targeted sectors include space and satellites, aerospace and defense, and policy research.
  • Cisco rated CVE-2026-20127 as CVSS 10.0, noted limited active exploitation without a workaround, and urged updates to fixed releases.
  • Talos assessed infrastructure overlap with Silent Train with high confidence. This does not establish that UAT-11473 and Volt Typhoon are the same actor, or confirm Chinese government involvement.

Inference

  • Inference: Investigate beyond management plane compromise to include vdaemon injection, /var/tmp artifacts, and IPsec key extraction.
  • Inference: Do not treat infrastructure overlap as sole confirmation of government attribution.

Hypothesis

No additional hypotheses. Unverified items are documented in the Unresolved Questions and Limitations section.

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1190 Exploit Public-Facing Application high Authentication bypass targeting accessible management and control planes via CVE-2026-20127.
T1055.008 Ptrace System Calls high Injection into vdaemon using ptrace via rsshd.
T1059.004 Unix Shell high Command execution capability via /bin/sh -c in PolyFlame.

14. Unresolved Questions and Limitations

  • The number of victim organizations, whether extracted keys were used in subsequent communications, and the definitive relationship between UAT-11473 and Volt Typhoon remain unknown.
  • LittleFilch transmission destinations were not recovered, and the success rate of key exfiltration, subsequent decryption scope, and the full privilege acquisition path from non-root access to implant deployment remain unconfirmed.

15. Impact on SOCs and Organizations

Organizations operating Catalyst SD-WAN should prioritize applying patched releases and isolating management planes, followed by retrospective investigations around vdaemon, /var/tmp, and unknown administrative authentication.

16. Summary by Role

  • SOC: Correlate vdaemon injections, /var/tmp/vdaemon.bin creations, and unknown UDP transmissions.
  • Administrators: Update to fixed releases and restrict management ports 22 and 830.
  • Users: User actions cannot prevent this; administrative updates and compromise investigations are required.

Top comments (0)