Ethical Hacking News
Hackers have exploited a critical Cisco SD-WAN flaw to plant custom malware that steals encryption keys. The vulnerability, rated at a CVSS score of 10.0, allows an unauthenticated remote attacker to bypass authentication and gain administrative privileges on the control systems that manage the SD-WAN network. The malware, dubbed KeyDrift, is designed to copy encryption keys and can accept commands within SD-WAN control traffic. Organizations must take immediate action to secure their systems and prevent the malware from spreading.
Hackers exploited a critical vulnerability in Cisco SD-WAN systems, allowing them to plant custom malware that steals encryption keys. The vulnerability, CVE-2026-20127, has a CVSS score of 10.0, making it one of the most severe vulnerabilities discovered in recent times. The malware, KeyDrift, can bypass authentication and gain administrative privileges, allowing the attacker to access the system. The malware copies encryption keys and stores them for later use, making it highly sophisticated and difficult to detect. The group behind KeyDrift has targeted various sectors, including space and satellite services, defense and aerospace technology, and policy research. Cisco has issued a warning and advised customers to upgrade to a fixed release or migrate to a fixed release as soon as possible. Customers are also advised to limit access to ports 22 and 830 to prevent the malware from spreading. Snort rules are available to detect inbound KeyDrift command-and-control connections. Cybersecurity experts urge organizations to take the threat seriously and take immediate action to secure their systems.
In a recent threat to the cybersecurity landscape, hackers have successfully exploited a critical vulnerability in Cisco SD-WAN systems to plant custom malware that steals encryption keys. The vulnerability, identified as CVE-2026-20127, has been rated at a CVSS score of 10.0, making it one of the most severe vulnerabilities discovered in recent times.
According to Cisco, the vulnerability allows an unauthenticated remote attacker to bypass authentication and gain administrative privileges on the control systems that manage the SD-WAN network. This enables the attacker to log in as a high-privileged internal account that is not root, providing them with full access to the system.
The malware, dubbed KeyDrift, is designed to copy the keys that encrypt traffic between sites and store them for later use. It is built to accept commands within SD-WAN control traffic, making it highly sophisticated and difficult to detect.
The group behind KeyDrift, tracked as UAT-11473, has targeted various sectors, including space and satellite services, defense and aerospace technology, and policy research. The group's infrastructure overlaps considerably with that of Silent Train, a network of hacked devices used by Lumen's Black Lotus Labs.
Cisco has issued a warning and advised customers to take immediate action to secure their systems. The company has added a fix to its latest release train, but customers are advised to upgrade to a fixed release or migrate to a fixed release as soon as possible.
In addition to the fix, Cisco recommends that customers limit access to ports 22 and 830 to the IP addresses of known controllers and other known systems. This can help prevent the malware from spreading, but it is not a foolproof solution.
Talos, a cybersecurity firm, has released Snort rules to detect inbound KeyDrift command-and-control connections. The rules can be enabled by users with access to the paid Snort Subscriber rule set.
Cybersecurity experts are urging organizations to take the threat seriously and take immediate action to secure their systems. The use of the KeyDrift malware is a stark reminder of the importance of staying up-to-date with the latest security patches and taking proactive measures to protect against cyber threats.
In conclusion, the exploitation of the CVE-2026-20127 vulnerability and the use of the KeyDrift malware represent a significant threat to the cybersecurity landscape. Organizations must take immediate action to secure their systems and prevent the malware from spreading.
Related Information:
https://www.ethicalhackingnews.com/articles/Hackers-Exploit-Critical-Cisco-SD-WAN-Flaw-to-Plant-Malware-and-Steal-Encryption-Keys-ehn.shtml
https://thehackernews.com/2026/10/hackers-exploited-cisco-sd-wan-flaw-to.html
https://news.lavx.hu/article/hackers-exploited-cisco-sd-wan-flaw-to-steal-encryption-keys-with-custom-malware
https://nvd.nist.gov/vuln/detail/CVE-2026-20127
https://www.cvedetails.com/cve/CVE-2026-20127/
Published: Thu Oct 29 05:03:10 2026 by llama3.2 3B Q4_K_M
