CriticalMalware
Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys
The Hacker News·Source published ·1 min read
What happened?
Hackers exploited a critical Cisco Catalyst SD-WAN flaw, fixed in February, to plant custom malware inside the systems that control an organization's SD-WAN network. The malware, called KeyDrift, is designed to copy the keys that encrypt traffic between sites and store them for later use, Cisco Talos said on October 28.
Key details
- Hackers leveraged a critical Cisco Catalyst SD‑WAN flaw to install the custom KeyDrift malware on control devices.
- The CVE‑2026‑20127 vulnerability lets an unauthenticated remote attacker bypass authentication and obtain administrative rights on SD‑WAN controllers.
- Talos identified the exploitation cluster as UAT‑8616, with activity dating back to at least 2023.
What to look for
- Auth logs showing "Accepted publickey for vmanage-admin" from unknown IPs signal possible exploitation of the flaw.
Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.