Cisco SD-WAN Networks Breached by Custom Malware Target

The Mechanics of the KeyDrift Intrusion

Malicious actors successfully exploited a severe vulnerability in Cisco Catalyst SD-WAN infrastructure to deploy specialized malware earlier this year. Disclosed by threat intelligence researchers on October 28, the campaign specifically targeted the central control systems of enterprise networks to compromise encrypted communications.

The security flaw, which Cisco addressed through an official software patch released in February, allowed unauthorized entry into network management nodes. Once inside the system, the attackers installed a newly discovered malicious tool designated as KeyDrift.

KeyDrift functions as a targeted surveillance mechanism built to harvest sensitive cryptographic material. Its primary objective is duplicating the security keys utilized for encrypting data sent securely between different corporate locations.

How Did the Attackers Access the Network Controllers?

By capturing these keys, the unauthorized software enables operators to retain access to secured data streams for future exploitation. Cisco Talos researchers are currently tracking these malicious activities under a specific campaign designation while analyzing the full scope of the breach.

The attackers leveraged a critical unpatched vulnerability in the Cisco Catalyst SD-WAN software before the February security advisory was applied. This security gap provided the necessary pathway to install the KeyDrift malware directly onto central network management units.

Frequently Asked Questions

Security teams urge all organizations to verify that their software updates are fully applied to prevent similar intrusions. While the original flaw was resolved months ago, this disclosure highlights the long-tail risks of delayed patch deployment in critical network infrastructure.

What is the main function of the KeyDrift malware? KeyDrift is engineered to copy the cryptographic keys used to secure traffic between various network sites. It stores these stolen keys for subsequent retrieval by the attackers.

When was the underlying vulnerability patched by Cisco? Cisco issued a security fix for the critical Catalyst SD-WAN vulnerability in February, prior to the recent threat intelligence disclosures.