Researchers Find Cisco SD‑WAN Flaw Exploited to Install Key‑Stealing Malware

A team of security analysts discovered that attackers took advantage of a serious vulnerability in Cisco’s Catalyst SD‑WAN solution to embed a custom malware strain, called KeyDrift, within the management layer of compromised networks.

Cisco issued a patch for the flaw in February, but before it was applied the defect let unauthenticated adversaries run code on the SD‑WAN controllers that direct traffic among corporate locations. Exploiting this gap, the intruders dropped the malicious payload onto the devices that store the cryptographic keys for site‑to‑site encryption.

KeyDrift’s purpose is to collect those encryption keys and keep them on the compromised system, enabling its operators to decode traffic traversing the SD‑WAN fabric. With the harvested keys, they can later listen to private communications, siphon data, or inject additional malicious code while bypassing typical encryption defenses.

According to Cisco’s advisory, the weakness lies in the SD‑WAN control plane that handles configuration and policy processing. The vendor rolled out a software update in early February to fix the code‑execution vulnerability, yet researchers indicate the exploitation occurred prior to many firms installing the patch.

Specialists caution that this breach highlights the dangers of postponing patch deployment on essential network infrastructure. SD‑WAN products are becoming pivotal for corporate connectivity, typically carrying the majority of inter‑office traffic, and a controller‑level compromise can produce extensive ramifications.

Cisco has responded by urging its clients to confirm the February update is in place and to inspect their SD‑WAN deployments for any unauthorized code. Security vendors advise watching for irregular key‑access activity and implementing network‑level segmentation to contain any possible breach.

Finding KeyDrift expands the tally of advanced supply‑chain and infrastructure assaults aimed at encryption systems. As more firms move toward cloud‑native networking, analysts stress that careful monitoring of firmware updates and robust incident‑response strategies will be crucial to counter comparable threats ahead.