POLYFLAMEPolyFlame

Primary module of the KeyDrift framework reported and named by Cisco Talos, used by UAT-11473 on Cisco SD-WAN controllers. Memory-resident, it is injected as libdssl.so into legitimate running vdaemon processes by the rsshd injector, and a distinct variant masquerades as the aaamgr service as aaamgrd, a statically linked packed loader with an RC4-encrypted embedded ELF payload, direct syscalls and a TracerPid anti-debug check. It interposes socket, DTLS and runtime-linker behaviour (recvfrom, sendto, getpeername, dlopen, dlsym, mprotect) to access SD-WAN control-plane traffic and receive tasking in-band rather than through a fixed external beacon; no hardcoded C2 address was recovered from the analyzed samples. Tasking is validated against an MD5 of the current date. It acts either as a TinyShell-like backdoor (command execution, file write, file read) or as a one-to-many intermediate C2 relaying data between its C2 and peers.