Cisco Talos: KeyDrift malware planted via exploited SD-WAN flaw

Cisco Talos reported on October 28 that attackers exploited a critical flaw in Cisco Catalyst SD-WAN, fixed in February, to plant custom malware inside the systems that control an organization's SD-WAN network. The Hacker News covered the findings the following day.

The malware, which Talos calls KeyDrift, is built to copy the keys that encrypt traffic between sites and store them for later use. In other words, the payload targets the material that protects the links connecting an organization's locations, not the endpoints on either side.

Talos describes the attacks as historical, but it does not say when they took place. That gap matters. Readers should not treat this as a fresh intrusion wave, and the report does not establish how many organizations were affected or who was behind the activity.

The practical takeaway for defenders is to check whether their SD-WAN controllers and managers are running a version that includes the February fix, and to treat the key material those systems hold as potentially exposed if they were unpatched. Rotating site-to-site encryption keys and reviewing controller logs for unexpected access are reasonable follow-ups, though the source does not detail specific indicators of compromise.

The story also underlines a familiar pattern: control-plane appliances that hold secrets make attractive targets long after a patch ships.