PolyFlame and LittleFilch lived inside vdaemon, where encryption was already open and ordinary beacon assumptions failed.
Cisco Talos recovered a malware framework operating inside compromised SD-WAN controllers, where it could inspect traffic after decryption and collect the keying material used by managed edge devices.
The framework, which Talos calls KeyDrift, followed exploitation of CVE-2026-20127, a critical authentication-bypass vulnerability in Cisco Catalyst SD-WAN control components. Cisco says the flaw can give an unauthenticated remote attacker a high-privileged internal account and access to NETCONF, placing network configuration within reach. Its advisory now records limited exploitation.
KeyDrift went deeper than administrative access. Talos found implants inside legitimate control-plane processes, a backdoor capable of command execution and peer relaying, and a collection component designed to extract sensitive material from decrypted control sessions. Observed targets included space and satellite services, defense and aerospace technology, and policy research.
The controller was both the entry point and the collection position. Once the attacker occupied the system that brokers trust across the SD-WAN fabric, management traffic, security telemetry, and intelligence value converged in one place.
Talos found KeyDrift components operating inside SD-WAN controller processes, where they could intercept decrypted control traffic and collect assessed data-plane keying material.
The controller could see what the wire could not
Encrypted transport protects control traffic while it crosses the network. It cannot conceal that traffic from the trusted process responsible for decrypting and using it.
Talos found KeyDrift’s PolyFlame component injected into the legitimate vdaemon process. From there, the implant could interpose on socket, DTLS, and runtime-linker behavior. It also provided a TinyShell-style backdoor and could act as an intermediate command-and-control relay for other peers.
A second component, LittleFilch, hooked the SSL read path inside vdaemon. Talos’ analysis found it parsing decrypted control-plane buffers for edge-node identifiers and a 32-byte field the researchers assess as AES-256 IPsec data-plane key material. The component encrypted collected records with RSA, staged them locally, and could transmit them in records resembling ordinary DTLS application data.
This design changes the defender’s vantage point. Perimeter monitoring may see an approved controller exchanging expected traffic with known peers. The malicious behavior occurs inside the process that gives that traffic meaning.
LittleFilch inspected control traffic after decryption and recorded identifiers plus a binary field Talos assesses as IPsec data-plane keying material.
PolyFlame and LittleFilch answer different questions
CVE-2026-20127 explains how an unauthenticated attacker could enter an affected controller. Cisco rates the vulnerability CVSS 10.0 and says it affects the Catalyst SD-WAN Controller, Manager, and Validator across on-premises and Cisco-hosted deployment types. There are no workarounds; fixed software releases are available.
PolyFlame establishes a residence and command path. Talos recovered a modified runit chain that launched a malicious conf shell script for sshd, used rsshd to inject libdssl.so into vdaemon, and preserved an alternate packed aaamgrd deployment on an affected vBond appliance. Those artifacts support process injection, in-band tasking, command execution, and peer relaying on analyzed systems.
LittleFilch establishes a separate collection path. Its libcommon.so module hooked the SSL read path in an affected vSmart process, selected decrypted records for predefined edge nodes, and wrote RSA-encrypted output to /var/tmp/vdaemon.bin. Talos assesses the 32-byte field it parsed as OMP-distributed AES-256 IPsec data-plane key material.
Exposure, successful exploitation, PolyFlame residence, LittleFilch collection, and transmission of staged records are separate findings. The recovered framework shows the intended chain; each organization still has to establish which stages occurred on its own systems.
The implant avoided a familiar beacon
Talos did not recover hardcoded callback domains, URLs, fixed external addresses, or a polling interval from the analyzed PolyFlame samples. The implant was designed for in-band control or tasking through SD-WAN control traffic.
That is an efficient place to hide. A controller already maintains privileged, encrypted relationships with many devices. An implant inside that process can receive tasking, relay commands, and observe state without creating the clean outbound pattern defenders expect from conventional endpoint malware.
Talos also found persistence anchored in modified runit service paths, process injection into vdaemon, service-name masquerading, packed components, anti-debug behavior, and signs of timestomping. The individual artifacts matter, but the stronger detection model is behavioral: controller services changing unexpectedly, executable overlays being remounted, unfamiliar modules appearing inside trusted daemons, and peer relationships that do not match the environment’s architecture.
PolyFlame could use trusted control-plane traffic for tasking and peer relaying without relying on a conventional fixed external beacon.
The target set explains the value of the position
Talos observed targeting across satellite and space services, defense and aerospace technology, and policy research. Those sectors depend on managed connectivity while also carrying intelligence value during geopolitical tension.
The researchers assess with high confidence that UAT-11473’s operating infrastructure substantially overlaps the Silent Train covert-access network associated with Volt Typhoon. Separate research from Lumen’s Black Lotus Labs describes Silent Train as a rotating, compartmentalized framework built from compromised SOHO, IoT, and enterprise devices, with repeated attention to centralized management and control-plane systems.
Infrastructure overlap supplies important analytical context, while the public evidence presented for KeyDrift remains Talos’ cluster-level assessment. The operational pattern is clear regardless of the final actor label: compromise systems with broad administrative reach, live within trusted traffic, collect material that supports durable access, and reduce the external signals available to defenders.
A valid stolen endpoint credential may grant access as one identity. A compromised controller can expose relationships among many identities, devices, routes, and cryptographic sessions. That concentration is what makes the control plane strategically useful.
Hunt the process boundary, then scope the keys
Cisco’s fixed releases close CVE-2026-20127, and exposed controllers should be upgraded urgently. The useful investigation question is which KeyDrift components crossed the process boundary before that upgrade.
Security teams should:
Establish whether each controller was exposed during the vulnerable window and whether it now runs a fixed release.
Preserve volatile process and module state where response procedures allow, then hunt for altered runit launchers, a malicious conf shell script for sshd, rsshd, libdssl.so, the packed aaamgrd variant, and unexpected executable overlays.
Inspect vdaemon for the LittleFilch libcommon.so hook and look for /var/tmp/vdaemon.bin; the deleted-after-read /var/tmp/vdaemon.conf may leave no recoverable copy.
Review authentication records for unauthorized public-key acceptance involving vmanage-admin, then correlate that evidence with service starts and injection artifacts rather than treating login evidence alone as proof of KeyDrift.
Map PolyFlame’s peer connections and in-band relay behavior against approved controller roles, system IPs, public addresses, and control-connection history.
If LittleFilch or its staging record is present, identify the edge-node identifiers and control sessions in scope, then work through the deployment-specific procedure for re-establishing affected data-plane key material.
Forward authentication, audit, service-start, and control-plane logs off the controller so later process-level activity has an independent record.
PolyFlame evidence calls for a command-and-relay investigation. LittleFilch evidence adds a key-collection investigation. Keeping those scopes separate prevents a vulnerability hit, an implant hit, and confirmed collection from being collapsed into one unsupported conclusion.
The decisive scope comes from which artifacts exist: PolyFlame for residence and relay behavior, LittleFilch and its staging records for key collection.
The decryption point is the detection boundary
KeyDrift’s advantage came from code placement. PolyFlame and LittleFilch executed where vdaemon had already decrypted control traffic, resolved peer relationships, and exposed process state that an observer on the wire could not see.
That makes the process boundary the practical detection boundary. Service-launch changes, injected modules, hook behavior, staging files, and unexpected peer activity carry more value here than a search for a familiar external beacon.
The deepest visibility problem in KeyDrift was created after decryption, inside the software trusted to make the network work. Defenders have to instrument that same layer if they want to see the next framework built on this idea.