Cisco SD-WAN exploitation and KeyDrift malware deployment
Threat actors are actively exploiting a vulnerability in Cisco SD-WAN infrastructure to achieve initial access and deploy the custom KeyDrift malware.
Triage facts
Revision 1- Applicability
- SD-WAN
- Evidence
- Unknown
- Severity
- Critical
- Action
- Immediate escalation
- Sources
- 1 public source
- Freshness
- Revision 1Nov 4, 09:17 UTC
- Source quality
- B2Very likely
Threat actors are actively exploiting a vulnerability in Cisco SD-WAN devices to gain unauthorized access and deploy a custom malware strain identified as KeyDrift. The extent of the vulnerability, specific affected versions, and the CVE identifier remain undisclosed as of this report.
Impact
The exploitation allows threat actors to establish persistence and deploy custom malware on network infrastructure, potentially leading to full device compromise and long-term C2 capabilities within affected enterprise networks.
Recommendation
- Inventory all Cisco SD-WAN infrastructure immediately.
- Review device administrative access logs for unauthorized sessions or account creation.
- Monitor egress traffic from Cisco SD-WAN control and management planes for anomalies that may indicate C2 communication for the KeyDrift malware.
- Engage with Cisco support to obtain current security guidance and monitor official security advisories for the release of patches related to SD-WAN exploitation.
Immediate actions
Review Cisco SD-WAN administrative logs for unauthorized login events or unusual configuration changes
Threat Hunt
Identify unauthorized persistent sessions or suspicious configuration scripts on Cisco SD-WAN appliances
Data: Cisco SD-WAN device audit logs, Netflow data
Enrichment needed
- KeyDrift malware indicators (CTI) No IOCs currently available to support automated blocking
Mitigations
Apply firmware updates and security patches as issued by Cisco
Cisco SD-WAN vulnerability