Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
Cisco Talos has identified a sophisticated advanced persistent threat actor, tracked as UAT-11473, exploiting an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances. The actor deployed a custom malware framework named KeyDrift, which consists of components like PolyFlame and LittleFilch designed for persistent access, backdoor command execution, and the exfiltration of sensitive control-plane keying material. Observed targeting spans space and satellite services, defense and aerospace technology, and policy research, with operational infrastructure overlapping considerably with Volt Typhoon's Silent Train covert access network. Open article →
- Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware
- Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys
- Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network
- Cisco SD-WAN Catalyst Controller attacks linked to Volt Typhoon’s Silent Train network
- Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys https://t.co/...