TL;DR Threat actors tracked as UAT-11473 exploited a critical authentication bypass flaw in Cisco SD-WAN Catalyst Controllers to deploy a custom implant called KeyDrift malware. Through this KeyDrift malware UAT-11473 operation, attackers injected malicious modules directly into control-plane processes to steal encryption keys and maintain hidden backdoors. Furthermore, investigators found strong infrastructure links connecting this campaign to Volt Typhoon's covert relay network.

TL;DR Threat actors tracked as UAT-11473 exploited a critical authentication bypass flaw in Cisco SD-WAN Catalyst Controllers to deploy a custom implant called KeyDrift malware. Through this KeyDrift malware UAT-11473 operation, attackers injected malicious modules directly into control-plane processes to steal encryption keys and maintain hidden backdoors. Furthermore, investigators found strong infrastructure links connecting this campaign to Volt Typhoon's covert relay network.