TechiSeek

VendorsFor Vendors

Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN

Cisco Talos Intelligence

Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN News

KeyDrift is a custom malware framework that UAT-11473 deployed after exploiting CVE-2026-20127, an authentication bypass in Cisco SD-WAN Catalyst Controller instances.

Implementation details

  • Poly Flame interposes socket, DTLS, and runtime-linker behavior through functions including recvfrom, sendto, getpeername, dlopen, dlsym, mprotect, and "/proc/%d/maps" parsing, giving access to control-plane traffic from inside legitimate controller daemon execution.
  • In the Poly Flame sshd deployment, the actor modifies the service run script, remounts /rootfs.rw executable, launches a malicious script "conf_sshd" in the background, then starts the legitimate sshd service.
  • The loader script enumerates running vdaemon PIDs, records them in "/tmp/system-vdaemon", and invokes the injector component "rsshd" to inject Poly Flame ("libdssl.so") into each process.

Known limitations

  • No hardcoded IPv4 addresses, binding ports, callback domains, URLs, host headers, or polling interval were recovered from the analyzed Poly Flame samples, so fixed-indicator detection is not viable.
  • Poly Flame is designed for in-band control or tasking over Cisco SD-WAN control-plane traffic rather than a conventional fixed external beacon.
Visit Site

Recommended

Goodfire says its new ‘inside-out’ monitors catch rogue AI agents at a fraction of the costGoodfire says its new ‘inside-out’ monitors catch rogue AI agents at a fraction of the costTechcrunch Facebook hosted over 70 cybercrime groups that advertised all types of illicit activityFacebook hosted over 70 cybercrime groups that advertised all types of illicit activitycyberscoop.com Microsoft Edge, Internet Explorer zero-days could allow spying on your browsing activityMicrosoft Edge, Internet Explorer zero-days could allow spying on your browsing activitycyberscoop.com How sloppy OPSEC gave researchers an inside look at the exploit industryHow sloppy OPSEC gave researchers an inside look at the exploit industrycyberscoop.com Inside a Chinese hacking group's very flexible playbookInside a Chinese hacking group's very flexible playbookcyberscoop.com Inside the online fight among DerbyCon leaders, illmob, and harassed infosec womenInside the online fight among DerbyCon leaders, illmob, and harassed infosec womencyberscoop.com The Most Important Work in AI Training Is Also the Most Overlooked - Deepgram Blog ⚡️The Most Important Work in AI Training Is Also the Most Overlooked - Deepgram Blog ⚡️Deepgram Redis Cloud PrivateRedis Cloud PrivateRedis Inside the Go Playground - The Go Programming LanguageInside the Go Playground - The Go Programming LanguageGo Position Sticky and Table HeadersPosition Sticky and Table HeadersCss Tricks 4 ways to automate notifications for Mercado Pago4 ways to automate notifications for Mercado PagoZapier Defining “View Source”Defining “View Source”Css Tricks AI Needs Data, Data Needs AI: Inside the Data Outpost AgendaAI Needs Data, Data Needs AI: Inside the Data Outpost AgendaMotherduck Callback function - GlossaryCallback function - GlossaryDeveloper Mozilla Cerebras Architecture Deep Dive: First Look Inside the HW/SW Co-Design for Deep Learning [Updated]Cerebras Architecture Deep Dive: First Look Inside the HW/SW Co-Design for Deep Learning [Updated]Cerebras OpenTelemetry Tracing ShimOpenTelemetry Tracing ShimOpentelemetry Socket Now Protects the Microsoft Edge Extension EcosystemSocket Now Protects the Microsoft Edge Extension EcosystemSocket Conductor: Why We Migrated from Kubernetes to NomadConductor: Why We Migrated from Kubernetes to NomadThenewstack Inside Modal Notebooks: How we built a cloud GPU notebook that boots in secondsInside Modal Notebooks: How we built a cloud GPU notebook that boots in secondsModal What is URL (Uniform Resource Identifier) and Percent Encoding?What is URL (Uniform Resource Identifier) and Percent Encoding?Bunny