Hackers exploit Cisco SD-WAN flaw plant KeyDrift malware

Attackers leveraged a critical Cisco Catalyst SD-WAN vulnerability, patched in February, to deploy KeyDrift malware designed to steal encryption keys controlling traffic between network sites. Cisco Talos confirmed the malware was built to copy and exfiltrate keys for later use. The attacks are historical in nature. Organizations should ensure SD-WAN systems are fully patched and monitor for KeyDrift indicators of compromise.