Cisco SD-WAN Exploited to Deploy KeyDrift Encryption-Key-Stealing Malware

Thu, 29 Oct 2026 17:24:45 +0000

Engineer — Act: If Cisco Catalyst SD-WAN is in your environment, confirm you applied the February 2026 patch, then audit devices for KeyDrift artifacts and rotate inter-site VPN encryption keys since prior compromise would leave stolen keys in attacker hands even after patching.
SOC/IR — Act: Cisco Talos published a named malware (KeyDrift) tied to confirmed SD-WAN exploitation; pull the Talos report for IOCs, sweep Cisco Catalyst SD-WAN management systems for KeyDrift indicators, and hunt for anomalous key-material exfiltration activity back to before the February patch date.
Leader — Act: Confirmed exploitation of Cisco SD-WAN infrastructure with encryption key theft means inter-site traffic confidentiality may be retroactively compromised; if your organization runs Cisco Catalyst SD-WAN, verify patch status with engineering this week and assess whether a disclosure or customer notification obligation applies.

Encryption-Key-Theft on CuraSec