Talos: Attackers stole Catalyst SD-WAN keys and deployed KeyDrift malware

Key points

• Cisco Talos reported past intrusions against Catalyst SD-WAN environments.
• Attackers abused a vulnerability, duplicated encryption keys, and retained them.
• KeyDrift malware was installed, threatening SD-WAN control functions.
• Cisco released a patch in February; details emerged on October 28.
• No CVE was assigned, and the number of victims remains unclear.

Cisco Talos has published findings on intrusions that targeted Cisco Catalyst SD-WAN environments. According to the research team, intruders abused a vulnerability in the platform, duplicated encryption keys used for protection, retained those keys, and installed malicious code identified as KeyDrift. The activity is described as having occurred in past campaigns, and the number of victims has not been quantified. Cisco issued a patch in February; the public disclosure came on October 28. No CVE identifier was attached to the issue.

Catalyst SD-WAN connects branches, data centers, and cloud services, so the affected population is any organization relying on the product—including public-sector and school-network operators that should now verify exposure. The combination of stolen keys and resident malware is significant because it can undermine trust in the overlay: an adversary with key material and a foothold may be able to interfere with control functions, decrypt or impersonate protected traffic, or persist quietly.

Because Talos refers to past campaigns rather than a confirmed ongoing operation, the immediate risk depends on patch status and whether indicators are present. The absence of a CVE does not make the issue less operationally relevant; it means defenders must rely on the vendor advisory, version checks, and their own telemetry. The February-to-October gap also means some environments may have remained unpatched for months.

Administrators should treat this as a key-compromise scenario, not just a malware cleanup. Rotating credentials and certificates, validating controller and edge integrity, and reviewing management-plane logs are essential. Watch for unexpected configuration changes, new trust relationships, anomalous control connections, and signs of KeyDrift on SD-WAN components. Confirm patch levels, preserve evidence, and escalate according to incident-response policy.

What to do now

1. Inventory all Catalyst SD-WAN controllers and edges, then apply Cisco's February patch immediately; treat unpatched systems as exposed.
2. Rotate and revoke SD-WAN encryption keys, certificates, and related credentials; assume key material may have been copied.
3. Hunt for KeyDrift malware and persistence mechanisms on SD-WAN components, isolating suspicious systems for forensics.
4. Review management-plane and control-plane logs for anomalous connections, configuration changes, key exports, and new trust relationships.
5. Restrict SD-WAN management access with MFA, network segmentation, and tight egress filtering; monitor for unusual outbound traffic.
6. Preserve evidence and engage Cisco Talos guidance or incident-response support; follow notification and escalation policy.
7. Track the vendor advisory in the risk register despite the lack of a CVE, and validate backups and recovery procedures.

Original source

The Hacker News