News
cybersecurity Hackers Steal 2.6 Million Records From Sony’s Japanese ISP So-net - SecurityWeek threat-intel Microsoft to Disable SMS and Voice Authentication in Entra ID Starting February 2027 - GBHackers threat-intel Microsoft Edge Security Flaws Allow Attackers to Execute Code Without Memory Corruption - GBHackers cybersecurity A Hacker Targeted High-Stakes Poker Players With Malware That Exposed Their Cards - Wired Security cybersecurity Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network - SecurityWeek cybersecurity KeyDrift Malware Hijacks Cisco SD-WAN Processes to Intercept Traffic and Extract IPsec Keys - CyberPress ai We urgently need to monitor AI agents’ actions in real time - MIT Technology Review ai Our climate models have a big, dangerous blind spot - MIT Technology Review cybersecurity Shadowy AI Relay Disables OpenAI Codex, Claude Code Sandboxes - Dark Reading cybersecurity Microsoft Edge Security Flaws Allow Attackers to Bypass Browser Sandbox and Execute Code - CyberPress cybersecurity Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August - SecurityWeek cybersecurity Ghost in the PHP2Shell: Why coordinated disclosure and patching will start moving faster - Aikido Security cybersecurity Millions of Chrome Users Had Their Searches Hijacked by 319 Suspicious Extensions - CyberPress threat-intel Volt Typhoon Hackers Exploit Multiple Zero-Days to Breach U.S. Critical Infrastructure Networks - GBHackers cybersecurity Cisco Warns of Actively Exploited Firewall Vulnerability Allowing Remote DoS Attacks - CyberPress
1 / 15
All news ›
Cybersecurity

KeyDrift Malware Hijacks Cisco SD-WAN Processes to Intercept Traffic and Extract IPsec Keys

CyberPress ·

Cisco Talos has uncovered KeyDrift, a custom malware framework that hides inside Cisco SD-WAN controller processes to intercept decrypted control traffic and collect sensitive encryption keys. Researchers linked the activity to UAT-11473, a sophisticated advanced persistent threat actor targeting strategically important organizations. The attackers exploited CVE-2026-20127, an authentication bypass vulnerability affecting Cisco Catalyst SD-WAN control […] The post KeyDrift Malware Hijacks Cisco SD-WAN Processes to Intercept Traffic and Extract IPsec Keys appeared first on Cyber Security News .

Continue on CyberPress ↗ ‹ All news Get the newsletter

The summary and image come from CyberPress; the image is shown from their website.