Researchers Find Cisco SD‑WAN Flaw Exploited to Install Key‑Stealing Malware

Researchers in cybersecurity have found that attackers exploited a severe vulnerability in Cisco’s Catalyst SD‑WAN system to embed a custom malware known as KeyDrift within the management layer of compromised networks.

Cisco issued a patch for the flaw in February, but before it was applied the weakness let unauthenticated adversaries run code on the SD‑WAN controllers that direct traffic among corporate locations. Exploiting this gap, the intruders dropped the malicious payload onto the devices storing the cryptographic keys for site‑to‑site encryption.

KeyDrift’s purpose is to collect those encryption keys and keep them on the compromised system, enabling its operators to decode traffic traversing the SD‑WAN fabric. With the pilfered keys, they can later listen in on private communications, siphon data, or inject additional malicious code while bypassing typical encryption‑based safeguards.

According to Cisco’s advisory, the defect lies within the SD‑WAN control plane that handles configuration and policy information. The vendor rolled out a software update in early February to remediate the code‑execution vulnerability, yet researchers indicate the exploitation occurred prior to many firms installing the patch.

Specialists caution that this event highlights the dangers of postponing patch deployment on essential network infrastructure. SD‑WAN products have become pivotal for corporate connectivity, frequently carrying the majority of inter‑office traffic, and a breach at the controller tier can produce extensive repercussions.

Cisco now advises its clients to confirm the February update is in place and to review their SD‑WAN setups for any unauthorized code. Security vendors suggest watching for irregular key‑access behavior and implementing network‑level segmentation to contain any possible breach.

KeyDrift’s identification expands the expanding catalog of advanced supply‑chain and infrastructure assaults aimed at encryption systems. As firms keep moving toward cloud‑native networking, analysts argue that close attention to firmware updates and robust incident‑response strategies will be crucial to counter comparable threats ahead.