# Cisco discloses SD-WAN malware designed to capture traffic encryption keys

_Published Thursday, October 29, 2026 at 6:06 AM EDT · Security, Infrastructure · Latest · Tier 2 — Notable_

![Cisco discloses SD-WAN malware designed to capture traffic encryption keys — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiDuVB5nQJHwAnAATDQxAqD8KtWk7IpNvBqXQq6RPkqJ72joLVDp5dUDDdYmRHlrbUhJQpaQQ59p245XjotvW2DNx_fKk7cPp0wJUsK0z5IQY2jXA1oP-YcYKLtSdBXnZJDNECWOzX9tP3-12cKXJm2A1KKoBsu9CEiOYKbgJDVqvQt7YRF8Fzd706YumA/s1700-nu-rw-lo-l85-e365/cisco-sdwan.jpg)

Cisco Talos disclosed October 28 that attackers exploited a critical Catalyst SD-WAN vulnerability to install KeyDrift, malware designed to copy encryption keys used for traffic between sites. Talos describes the attacks as historical and does not specify when they occurred or whether keys were transmitted.

On compromised Controllers, a component reads decrypted control messages and extracts a field Talos assesses as AES-256 key material. It encrypts the records and can send them to a configured address.

The flaw affects on-premises and Cisco-hosted control systems. Cisco has issued fixes, but blocking management ports does not remove malware already installed. Talos also released detection rules October 28; the Snort 2 rules are disabled by default.

## Sources

- [The Hacker News](https://thehackernews.com/2026/10/hackers-exploited-cisco-sd-wan-flaw-to.html)

---
Canonical: https://techandbusiness.org/newswire/wWXRqzHYrjsZ1gAAEca6ub
Published: 2026-10-29T10:06:57.336Z
Story chronology: 2026-10-28T00:00:00.000Z
Retrieved: 2026-10-29T12:30:09.402Z
Publisher: Tech & Business (techandbusiness.org)