KeyDrift Malware Exploited Cisco SD-WAN Flaw to Harvest Encryption Keys

Cisco Talos has disclosed that attackers exploited a critical vulnerability in Cisco Catalyst SD-WAN to deploy custom malware designed to steal the encryption keys that protect traffic between an organization's network sites. The malware, dubbed KeyDrift, was described by the research team on October 28, with the underlying flaw having been patched back in February.

While Talos characterizes the activity as historical, the researchers have not specified exactly when the intrusions took place — a gap that leaves defenders uncertain how far back they need to hunt for evidence of compromise.

What KeyDrift Does

The focus of KeyDrift is not data destruction or ransomware deployment. Instead, it targets the cryptographic material at the heart of SD-WAN deployments: the keys used to encrypt traffic flowing between branch locations and the controllers that manage the network fabric.

By copying these keys and storing them for later retrieval, an attacker positions themselves to potentially decrypt or impersonate site-to-site communications long after the initial intrusion has been cleaned up. This is a classic espionage-style objective — quietly acquiring the means to read protected traffic rather than disrupting operations.

SD-WAN controllers are an especially attractive target because they sit at a central point of trust. Compromise of the systems that manage policy and key distribution can grant visibility into, or influence over, the entire overlay network.

The Vulnerability and Its Timeline

The exploited flaw was rated critical and received a fix in February. The gap between patch availability and reported exploitation reinforces a familiar pattern: attackers move quickly against internet-exposed network infrastructure, and organizations that delay applying updates remain exposed.

Talos's description of the attacks as "historical" suggests the exploitation window has passed or that the activity predates the current disclosure. However, without a precise timeline, security teams should treat any unpatched or recently patched Catalyst SD-WAN deployment as a candidate for investigation.

Why This Matters for Network Defenses

Edge and management infrastructure — VPN concentrators, firewalls, SD-WAN controllers — has become a favored entry point for both financially motivated criminals and state-linked actors. These devices are often internet-facing, run proprietary software, and may be overlooked by endpoint-focused detection tooling.

KeyDrift adds a further concern: even organizations that detect and remove an intrusion may find that stolen key material remains useful to the adversary. Rotating affected keys and certificates should therefore be part of any remediation plan, not just patching and malware removal.

Recommended Actions

Cisco Talos and general best practice point to several steps for organizations running Catalyst SD-WAN:

  • Verify patch status. Confirm that the February fix for the critical flaw is applied across all controllers and relevant components.
  • Hunt for indicators. Review Talos guidance and any published indicators of compromise for signs of KeyDrift or related post-exploitation activity on management systems.
  • Rotate cryptographic material. If compromise is suspected, treat site-to-site encryption keys and associated certificates as potentially exposed and plan rotation accordingly.
  • Restrict management access. Limit exposure of SD-WAN management interfaces to trusted networks and enforce strong authentication.
  • Monitor for anomalous behavior. Watch for unexpected file access to key stores, unusual outbound connections from controllers, and configuration changes that were not authorized.

The Bigger Picture

The KeyDrift disclosure is a reminder that patching is necessary but not always sufficient. When attackers target the control plane of a network, the consequences can persist beyond the lifetime of the malware itself. Organizations should pair rapid patching of edge infrastructure with key hygiene, network segmentation, and continuous monitoring of the systems that hold their trust anchors.

Talos has not attributed the activity to a specific threat actor, and further details — including the exact exploitation window — may emerge as investigations continue.

Original source: The Hacker News — Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys