LITTLEFILCHLittleFilch

Collection and exfiltration module of the KeyDrift framework reported and named by Cisco Talos, used by UAT-11473 on Cisco SD-WAN controllers. Delivered as libcommon.so into the vSmart vdaemon process, it installs an SSL_read hook, inspects decrypted control-plane buffers and, for a predefined list of edge nodes, extracts the vEdge public/transport IP, the peer system-IP and a 32-byte field that Talos assesses to be OMP-distributed AES-256 IPsec data-plane key material. It RSA-encrypts the records into /var/tmp/vdaemon.bin and can send them over UDP in DTLS 1.2 application-data style records to an endpoint read from /var/tmp/vdaemon.conf, which it deletes after reading.