Hackers exploited a critical Cisco Catalyst SD-WAN flaw to plant custom malware, named KeyDrift, within systems controlling an organization's SD-WAN network.
The malware is designed to copy encryption keys used for traffic between sites and store them for later use, according to Cisco Talos.
Cisco Talos described these attacks as historical, noting that the exploited vulnerability was fixed in February.
Sources and references
Original report
Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys
The Hacker News
Read on The Hacker News (opens in a new tab)Ref 00UFHM2X
Cite this
APA
Interestana AI Editorial. (2026, October 29). Hackers Use Cisco SD-WAN Flaw for Malware. Interestana. https://interestana.com/articles/hackers-exploited-cisco-sd-wan-flaw-to-plant-malware-built-to-steal-encryption-keys-00ufhm2x
MLA
“Hackers Use Cisco SD-WAN Flaw for Malware.” Interestana, 29 Oct. 2026, interestana.com/articles/hackers-exploited-cisco-sd-wan-flaw-to-plant-malware-built-to-steal-encryption-keys-00ufhm2x.
Chicago
Interestana AI Editorial. “Hackers Use Cisco SD-WAN Flaw for Malware.” Interestana, October 29, 2026. https://interestana.com/articles/hackers-exploited-cisco-sd-wan-flaw-to-plant-malware-built-to-steal-encryption-keys-00ufhm2x.
BibTeX
@misc{interestana_00ufhm2x,
author = {{Interestana AI Editorial}},
title = {{Hackers Use Cisco SD-WAN Flaw for Malware}},
howpublished = {Interestana},
year = {2026},
month = oct,
url = {https://interestana.com/articles/hackers-exploited-cisco-sd-wan-flaw-to-plant-malware-built-to-steal-encryption-keys-00ufhm2x},
note = {Summary of reporting by The Hacker News, https://thehackernews.com/2026/10/hackers-exploited-cisco-sd-wan-flaw-to.html}
}Credit the source
Original reporting: The Hacker News, “Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys”, https://thehackernews.com/2026/10/hackers-exploited-cisco-sd-wan-flaw-to.html(opens in a new tab)
Follow this story
Get Cybersecurity in your inbox — new stories in 40 words or fewer, once a week.
Subscribe