conv.

All stories
SecurityQuiet 9d · day 14

APT Group Exploits Cisco SD-WAN Flaw to Deploy KeyDrift Malware

Attackers used a critical authentication-bypass vulnerability to install custom malware designed to steal encryption keys from Cisco Catalyst SD-WAN Controllers.

newest coverage 8d agosummary written 9d ago10 pieces Google NewsMastodonReddit

What to know

  • APT group UAT-11473 exploited CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers.
  • The group deployed KeyDrift, a custom malware framework designed to steal encryption keys from affected systems.
  • The vulnerability and exploitation were identified in late October 2026.

UAT-11473 Advanced persistent threat groupCisco Affected vendor

How it unfolded 2 developments, newest first · click a bar or a number to jump articlesposts

Peak 4 pieces in 4h at Oct 29, 3 AM; 10 pieces over 14 days (6 articles · 4 posts) Oct 28, 11 AM — 2 pieces · 2 articles — Google News 2Oct 28, 3 PM — quietOct 28, 7 PM — quietOct 28, 11 PM — quietOct 29, 3 AM — 4 pieces · 4 articles — Google News 4Oct 29, 7 AM — quietOct 29, 11 AM — 1 piece · 1 post — Mastodon 1Oct 29, 3 PM — quietOct 29, 7 PM — quietOct 29, 11 PM — quietOct 30, 3 AM — 1 piece · 1 post — Reddit 1Oct 30, 7 AM — quietOct 30, 11 AM — quietOct 30, 3 PM — quietOct 30, 7 PM — quietOct 30, 11 PM — quietOct 31, 3 AM — quietOct 31, 7 AM — quietOct 31, 11 AM — quietOct 31, 3 PM — quietOct 31, 7 PM — quietOct 31, 11 PM — quietNov 1, 2 AM — quietNov 1, 6 AM — quietNov 1, 10 AM — quietNov 1, 2 PM — quietNov 1, 6 PM — quietNov 1, 10 PM — 1 piece · 1 post — Mastodon 1Nov 2, 2 AM — quietNov 2, 6 AM — quietNov 2, 10 AM — quietNov 2, 2 PM — quietNov 2, 6 PM — quietNov 2, 10 PM — 1 piece · 1 post — Mastodon 1Nov 3, 2 AM — quietNov 3, 6 AM — quietNov 3, 10 AM — quietNov 3, 2 PM — quietNov 3, 6 PM — quietNov 3, 10 PM — quietNov 4, 2 AM — quietNov 4, 6 AM — quietNov 4, 10 AM — quietNov 4, 2 PM — quietNov 4, 6 PM — quietNov 4, 10 PM — quietNov 5, 2 AM — quietNov 5, 6 AM — quietNov 5, 10 AM — quietNov 5, 2 PM — quietNov 5, 6 PM — quietNov 5, 10 PM — quietNov 6, 2 AM — quietNov 6, 6 AM — quietNov 6, 10 AM — quietNov 6, 2 PM — quietNov 6, 6 PM — quietNov 6, 10 PM — quietNov 7, 2 AM — quietNov 7, 6 AM — quietNov 7, 10 AM — quietNov 7, 2 PM — quietNov 7, 6 PM — quietNov 7, 10 PM — quietNov 8, 2 AM — quietNov 8, 6 AM — quietNov 8, 10 AM — quietNov 8, 2 PM — quietNov 8, 6 PM — quietNov 8, 10 PM — quietNov 9, 2 AM — quietNov 9, 6 AM — quietNov 9, 10 AM — quietNov 9, 2 PM — quietNov 9, 6 PM — quietNov 9, 10 PM — quietYesterday, 2 AM — quietYesterday, 6 AM — quietYesterday, 10 AM — quietYesterday, 2 PM — quietYesterday, 6 PM — quietYesterday, 10 PM — quietToday, 2 AM — quietToday, 6 AM — quietToday, 10 AM — quietToday, 2 PM — quietToday, 6 PM — quiet 12
Oct 29Oct 31Nov 2Nov 4Nov 6Nov 8now · 9:14 PM ET
  1. 2

    CVE-2026-20127 identified as authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers

    Security coverage identified the vulnerability as CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, attributed to APT group UAT-11473.

    “A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift.”
    — BleepingComputer · source
    1. 4 outlets Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware

      first by BleepingComputer, 13d ago · also 2-Spyware, CyberSecurityNews, The News International

      3 more headlines
    • BleepingComputer@infosec.exchange

      A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift. https://www. bleepingcomputer.com/news/secu…

      BleepingComputer@infosec.exchangeMastodon13d agoview on Mastodon ↗
  2. 1

    Hackers exploit Cisco SD-WAN flaw to plant KeyDrift malware

    Security researchers identified that attackers exploited a Cisco SD-WAN vulnerability to deploy custom malware designed to steal encryption keys from affected systems.

    1. 1 outlet first by The Hacker News, 14d ago · read ↗