SD-WAN - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/sd-wan/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 04 Nov 2026 09:17:28 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCisco SD-WAN exploitation and KeyDrift malware deploymenthttps://feed.craftedsignal.io/briefs/2026-11-cisco-sd-wan-keydrift/Wed, 04 Nov 2026 09:17:28 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-cisco-sd-wan-keydrift/Threat actors are actively exploiting a vulnerability in Cisco SD-WAN infrastructure to achieve initial access and deploy the custom KeyDrift malware.Threat actors are actively exploiting a vulnerability in Cisco SD-WAN devices to gain unauthorized access and deploy a custom malware strain identified as KeyDrift. The extent of the vulnerability, specific affected versions, and the CVE identifier remain undisclosed as of this report.

Impact

The exploitation allows threat actors to establish persistence and deploy custom malware on network infrastructure, potentially leading to full device compromise and long-term C2 capabilities within affected enterprise networks.

Recommendation

  1. Inventory all Cisco SD-WAN infrastructure immediately.
  2. Review device administrative access logs for unauthorized sessions or account creation.
  3. Monitor egress traffic from Cisco SD-WAN control and management planes for anomalies that may indicate C2 communication for the KeyDrift malware.
  4. Engage with Cisco support to obtain current security guidance and monitor official security advisories for the release of patches related to SD-WAN exploitation.
]]>criticaladvisoryciscosd-wanmalwarec2active-exploitation