Cisco Talos has disclosed that attackers exploited a critical vulnerability in Cisco Catalyst SD-WAN systems, which was originally addressed in February, to deploy specialized malware. The malicious software, identified as KeyDrift, was found within the control systems of SD-WAN networks. According to reports released on October 28, the primary function of this malware is to copy encryption keys responsible for securing traffic between different sites, storing the data for subsequent use by the attackers.

The intrusion method targeted the orchestration layer of the software-defined wide area network, allowing the threat actors to gain a foothold in the infrastructure that manages global connectivity. Cisco Talos categorized these attacks as historical, though the specific timeline of the initial breaches was not disclosed. The discovery highlights the persistent risk of attackers leveraging known vulnerabilities in networking hardware to perform deep-seated surveillance and data theft.

For CIOs and IT directors, this incident underscores the necessity of maintaining rigorous patching cycles for core networking infrastructure. Even after a fix is released, unpatched systems remain high-value targets for custom malware designed to compromise long-term data confidentiality. Operations leaders should verify that all SD-WAN controllers are updated to the latest secure firmware versions to mitigate the risk of similar credential and key exfiltration.

The BroadVision view

This exploitation demonstrates that core network infrastructure remains a primary target for sophisticated persistent threats. Mid-market IT teams must prioritize rapid patch management and continuous monitoring of control plane activity to protect encrypted traffic flows. Maintaining oversight of SD-WAN security configurations is essential for preserving the integrity of wide area network communications through proactive connectivity and infrastructure management. Teams weighing what to change first can review BroadVision's managed IT services.