{
  "id": 17035909,
  "title": "Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys",
  "url": "https://urgent.news/2026/10/29/hackers-exploited-cisco-sd-wan-flaw-to-plant-malware-built-to-steal",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-29T08:24:22.000Z",
  "source": {
    "name": "The Hacker News",
    "slug": "the-hacker-news",
    "url": "https://thehackernews.com/2026/10/hackers-exploited-cisco-sd-wan-flaw-to.html"
  },
  "original_language": "en",
  "account": "Hackers took advantage of a recently patched vulnerability in Cisco's Catalyst SD-WAN systems to inject malware capable of stealing encryption keys, according to an analysis by Cisco Talos. The malware, dubbed KeyDrift, was designed to copy encryption keys used to secure traffic between different SD-WAN sites, allowing the attackers to store them for future use. Cisco has tracked this flaw as CVE-2026-20127, which carries a high CVSS score of 10.0 and can be exploited by unauthenticated remote attackers to gain administrative access to the control systems.\n\nThe security researchers discovered that KeyDrift operates by hooking into a process called vdaemon, which handles control connections carrying the encryption keys. Once inside, the malware reads the keys and encrypts them using RSA before sending the data to a predetermined address. Talos has linked the KeyDrift group to a larger network known as Silent Train, which has been associated with various high-profile cyber threats. However, the exact relationship between the two remains unclear.\n\nCisco promptly released a patch for the vulnerability in February, but attackers continued to exploit it even after the disclosure. The group responsible for KeyDrift overlaps with another threat actor known as Volt Typhoon, though the exact connection between the two groups is not definitively established. Lumen, a Cisco subsidiary, reported that the group had been exploiting the vulnerability as late as late 2025, even after Cisco's initial patch.\n\nThe vulnerability affects Cisco's Catalyst SD-WAN Controller, Manager, and Validator systems, regardless of their configuration. On-premises deployments and cloud-based services are equally at risk. Cisco has recommended several remediation steps, including limiting access to specific ports and upgrading to the latest software versions. However, these measures may not completely eliminate the threat, as the malware could potentially remain on compromised devices. Cisco advises organizations to install the patches, follow hardening guidelines, and monitor for signs of post-compromise activity.",
  "summary": "Hackers exploited a critical Cisco Catalyst SD-WAN flaw, fixed in February, to plant custom malware inside the systems that control an organization's SD-WAN network. The malware, called KeyDrift, is designed to copy the keys that encrypt traffic between sites and store them for later use, Cisco Talos said on October 28. Talos calls the attacks historical but does not specify when they",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}