Act
active
Cisco SD-WAN Exploited to Deploy KeyDrift Encryption-Key-Stealing Malware
- Engineer — Act: If Cisco Catalyst SD-WAN is in your environment, confirm you applied the February 2026 patch, then audit devices for KeyDrift artifacts and rotate inter-site VPN encryption keys since prior compromise would leave stolen keys in attacker hands even after patching.
- SOC/IR — Act: Cisco Talos published a named malware (KeyDrift) tied to confirmed SD-WAN exploitation; pull the Talos report for IOCs, sweep Cisco Catalyst SD-WAN management systems for KeyDrift indicators, and hunt for anomalous key-material exfiltration activity back to before the February patch date.
- Leader — Act: Confirmed exploitation of Cisco SD-WAN infrastructure with encryption key theft means inter-site traffic confidentiality may be retroactively compromised; if your organization runs Cisco Catalyst SD-WAN, verify patch status with engineering this week and assess whether a disclosure or customer notification obligation applies.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.