Cisco SD-WAN Vulnerability Used to Deploy Key‑Stealing Malware, Researchers Find

Security researchers have uncovered that threat actors leveraged a critical flaw in Cisco’s Catalyst SD‑WAN platform to insert a bespoke piece of malware, dubbed KeyDrift, into the management infrastructure of affected networks.

The vulnerability, which Cisco patched in February, allowed unauthenticated attackers to execute code on the SD‑WAN controllers that orchestrate traffic between corporate sites. By exploiting the unpatched window, the attackers were able to plant the malicious payload directly onto devices that hold the cryptographic keys used for site‑to‑site encryption.

KeyDrift is designed to harvest those encryption keys and store them locally, giving the operators of the malware the ability to decrypt traffic flowing across the SD‑WAN fabric. The stolen keys could be used later to eavesdrop on confidential communications, exfiltrate data, or insert further malicious code without triggering standard encryption‑based defenses.

Cisco’s advisory notes that the flaw resides in the SD‑WAN’s control plane, where configuration and policy data are processed. The company released a software update in early February that addresses the underlying code execution issue, but the researchers say the attack was carried out before many organizations applied the fix.

Experts warn that the incident underscores the risks of delayed patch management in critical network infrastructure. SD‑WAN solutions are increasingly central to corporate connectivity, often handling the bulk of inter‑office traffic, and a compromise at the controller level can have far‑reaching consequences.

In response, Cisco has urged customers to verify that the February patch has been installed and to audit their SD‑WAN environments for signs of unauthorized code. Security firms recommend monitoring for anomalous key‑access patterns and employing network‑level segmentation to limit the impact of any potential breach.

The discovery of KeyDrift adds to a growing list of sophisticated supply‑chain and infrastructure attacks targeting encryption mechanisms. As organizations continue to adopt cloud‑native networking, analysts say vigilance around firmware updates and thorough incident‑response planning will be essential to mitigate similar threats in the future.