CERT24Inside KeyDrift: Historical UAT-11473 activity on Cisco SD-WANLoading data…
CERT24Threat Observatory
Period

Inside KeyDrift: Historical UAT-11473 activity on Cisco SD-WAN

Cisco Talos describes activity by UAT-11473 involving exploitation of the Cisco SD-WAN Catalyst Controller authentication-bypass vulnerability CVE-2026-20127 and deployment of the KeyDrift malware framework. The activity included control-plane traffic interception, collection of sensitive keying material, backdoor functionality, and encrypted staging or transmission of collected data.

← Back to intelligence

Inside KeyDrift: Historical UAT-11473 activity on Cisco SD-WAN

Cisco Talos describes activity by UAT-11473 involving exploitation of the Cisco SD-WAN Catalyst Controller authentication-bypass vulnerability CVE-2026-20127 and deployment of the KeyDrift malware framework. The activity included control-plane traffic interception, collection of sensitive keying material, backdoor functionality, and encrypted staging or transmission of collected data.