Hackers Exploit Cisco Catalyst SD‑WAN Flaw to Deploy KeyDrift Malware and Steal Encryption Keys
What Happened — Cisco Talos disclosed that threat actors leveraged a critical vulnerability in Cisco Catalyst SD‑WAN (patched in February 2026) to install a custom back‑door dubbed KeyDrift. The malware silently copies the symmetric keys used to encrypt inter‑site traffic and stores them for later retrieval, giving attackers the ability to decrypt traffic flowing across the compromised SD‑WAN fabric. The activity was observed in the wild in October 2026; Cisco confirmed the exploitation is historical but warned that any unpatched devices remain at risk.
Why It Matters for Trust & Control Assurance — The incident tests the control objective of protecting cryptographic keys and demonstrates the need for continuous verification that key‑management controls are enforced across network infrastructure.
Who Is Affected — Enterprises that deploy Cisco SD‑WAN, Managed Service Providers that manage SD‑WAN environments, and any organization that relies on encrypted site‑to‑site traffic.
Recommended Actions
- Verify that all Cisco Catalyst SD‑WAN devices are running the February 2026 security release.
- Rotate all encryption keys that were in use before the patch date and enforce short key‑lifetime policies.
- Deploy continuous monitoring and integrity‑checking of SD‑WAN control planes to detect unauthorized code.
- Update incident‑response playbooks to include key‑theft scenarios and evidence‑preservation steps.
Source: The Hacker News
Technical Notes —
- Attack vector: Exploitation of a software vulnerability in the Cisco Catalyst SD‑WAN controller.
- Malware: KeyDrift – custom code that extracts and stores IPsec/DTLS encryption keys.
- Patch status: Fixed in Cisco’s February 2026 release (CVE pending).
- Data types at risk: Cryptographic keys that protect all inter‑site traffic.
Source: Cisco Talos Advisory