Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys

Hackers took advantage of a critical vulnerability in Cisco Catalyst SD-WAN to install custom malware within the systems controlling an organization's SD-WAN network. The malware, known as KeyDrift, is intended to capture and store encryption keys used to secure traffic between sites. This flaw was addressed in February, and the attacks are considered historical by Cisco Talos. The malware's purpose is to copy these encryption keys for potential later use. Cisco Talos disclosed this information on October 28. The exact timing of the attacks is not specified by Talos.