{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/sd-wan/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SD-WAN"],"_cs_severities":["critical"],"_cs_tags":["cisco","sd-wan","malware","c2","active-exploitation"],"_cs_type":"advisory","_cs_vendors":["Cisco"],"content_html":"\u003cp\u003eThreat actors are actively exploiting a vulnerability in Cisco SD-WAN devices to gain unauthorized access and deploy a custom malware strain identified as KeyDrift. The extent of the vulnerability, specific affected versions, and the CVE identifier remain undisclosed as of this report.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe exploitation allows threat actors to establish persistence and deploy custom malware on network infrastructure, potentially leading to full device compromise and long-term C2 capabilities within affected enterprise networks.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInventory all Cisco SD-WAN infrastructure immediately.\u003c/li\u003e\n\u003cli\u003eReview device administrative access logs for unauthorized sessions or account creation.\u003c/li\u003e\n\u003cli\u003eMonitor egress traffic from Cisco SD-WAN control and management planes for anomalies that may indicate C2 communication for the KeyDrift malware.\u003c/li\u003e\n\u003cli\u003eEngage with Cisco support to obtain current security guidance and monitor official security advisories for the release of patches related to SD-WAN exploitation.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-11-04T09:17:28Z","date_published":"2026-11-04T09:17:28Z","id":"https://feed.craftedsignal.io/briefs/2026-11-cisco-sd-wan-keydrift/","summary":"Threat actors are actively exploiting a vulnerability in Cisco SD-WAN infrastructure to achieve initial access and deploy the custom KeyDrift malware.","title":"Cisco SD-WAN exploitation and KeyDrift malware deployment","url":"https://feed.craftedsignal.io/briefs/2026-11-cisco-sd-wan-keydrift/"}],"language":"en","title":"CraftedSignal Threat Feed - SD-WAN","version":"https://jsonfeed.org/version/1.1"}