Threat Investigation
Request a demo
Other threat group

UAT-11473

UAT-11473 is classified as other threat group.

Type
Other threat group

Highly sophisticated APT reported and named by Cisco Talos that exploited CVE-2026-20127, an authentication bypass in Cisco SD-WAN Catalyst Controller, to gain unauthorized access and install the custom KeyDrift malware framework (PolyFlame, LittleFilch), designed for long-term persistent access and automated exfiltration of sensitive keying material from SD-WAN control-plane processes. Observed targeting spans space and satellite services, defense and aerospace technology, and policy research. Talos assesses with high confidence that UAT-11473's operating infrastructure overlaps considerably with Volt Typhoon's Silent Train covert access network; this infrastructure overlap is the only link Talos reports between the two.

Threat Intelligence

Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.

UAT-11473 · Threat actors · Dark Radar