Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys

Hackers exploited a critical vulnerability in Cisco Catalyst SD-WAN to deploy custom malware named KeyDrift. The malware is specifically designed to steal encryption keys used to protect traffic between network sites. Cisco Talos disclosed the attacks on October 28, describing them as historical but without specifying exact dates. The vulnerability was patched by Cisco in February. KeyDrift stores the stolen encryption keys for later use, potentially enabling attackers to decrypt sensitive inter-site communications. The incident highlights the risk of delayed patching in critical network infrastructure components.