UAT-11473

Highly sophisticated APT reported and named by Cisco Talos that exploited CVE-2026-20127, an authentication bypass in Cisco SD-WAN Catalyst Controller, to gain unauthorized access and install the custom KeyDrift malware framework (PolyFlame, LittleFilch), designed for long-term persistent access and automated exfiltration of sensitive keying material from SD-WAN control-plane processes. Observed targeting spans space and satellite services, defense and aerospace technology, and policy research. Talos assesses with high confidence that UAT-11473's operating infrastructure overlaps considerably with Volt Typhoon's Silent Train covert access network; this infrastructure overlap is the only link Talos reports between the two.

Bu aktor haqqında dərc edilmiş hesabatlar:

• https://blog.talosintelligence.com/uat-11473-keydrift/
• https://thehackernews.com/2026/10/hackers-exploited-cisco-sd-wan-flaw-to.html

Mənbə: MISP Galaxy, Malpedia.