KEYDRIFTKeyDrift

Custom malware framework reported and named by Cisco Talos, installed by UAT-11473 in Cisco SD-WAN controller environments after exploiting the CVE-2026-20127 authentication bypass. Talos assesses with high confidence that it is designed for long-term persistent access and automated exfiltration of sensitive keying material. It uses Cisco SD-WAN runit service paths as its execution anchor: a modified sshd run script remounts /rootfs.rw executable and starts the conf_sshd loader script, which records the vdaemon PIDs and calls the rsshd ptrace injector to inject the main module PolyFlame into vdaemon, while on an affected vBond appliance a malicious aaamgr runit service runs the packed aaamgrd PolyFlame loader. Its LittleFilch module hooks SSL_read inside vdaemon to extract keying material from decrypted control traffic and stage it encrypted for exfiltration. Talos observed timestomping, and variations of the modules and deployment mechanisms suggesting active development.