Hackers Exploited Cisco SD-WAN Flaw to Plant Key-Stealing Malware

Cisco Talos said attackers exploited a critical Cisco Catalyst SD-WAN vulnerability, patched in February, to plant custom malware called KeyDrift. The malware copies keys that encrypt traffic between sites and stores them for later use.

• The Cisco Catalyst SD-WAN flaw was fixed in February 2026
• KeyDrift copies encryption keys for inter-site traffic
• Talos calls the attacks historical but gives no dates