Cisco Talos has identified UAT-11473 as an advanced persistent threat that exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances, to gain unauthorized access. The group installed a custom malware framework dubbed “KeyDrift,” which includes components such as PolyFlame and LittleFilch. PolyFlame is a memory-resident module injected into legitimate vdaemon processes via modified runit service paths and can masquerade as a packed “aaamgrd” loader. It interposes socket, DTLS and runtime-linker functions, allowing it to intercept decrypted control-plane traffic, extract keying material and provide a TinyShell-styled backdoor. LittleFilch hooks SSL_read inside vdaemon to stage encrypted exfiltration of the harvested keying data. Talos notes that the framework’s infrastructure overlaps with Volt Typhoon’s “Silent Train” network and that active development of its capabilities is observed. 1