News
cybersecurity Shadowy AI Relay Disables OpenAI Codex, Claude Code Sandboxes - Dark Reading cybersecurity Microsoft Edge Security Flaws Allow Attackers to Bypass Browser Sandbox and Execute Code - CyberPress cybersecurity Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August - SecurityWeek cybersecurity Ghost in the PHP2Shell: Why coordinated disclosure and patching will start moving faster - Aikido Security cybersecurity Millions of Chrome Users Had Their Searches Hijacked by 319 Suspicious Extensions - CyberPress threat-intel Volt Typhoon Hackers Exploit Multiple Zero-Days to Breach U.S. Critical Infrastructure Networks - GBHackers cybersecurity Cisco Warns of Actively Exploited Firewall Vulnerability Allowing Remote DoS Attacks - CyberPress threat-intel Alleged Wagyu Leak Contains 4,580 Completed Crypto Swaps Linking Monero Wallets to IP Addresses - GBHackers threat-intel 11 User & Entity Behavior Analytics (UEBA) Tools: The 2026 Buyer’s Verdict Guide - GBHackers threat-intel 12 Cyber Threat Intelligence (CTI) Feeds & Services: The 2026 Buyer’s Verdict Guide - GBHackers threat-intel CISA Adds Actively Exploited VMware ESXi Logging Flaw to KEV Catalog - GBHackers threat-intel 12 Threat Intelligence Platforms (TIP): The 2026 Buyer’s Verdict Guide - GBHackers cybersecurity HHS Filing Puts iRhythm Data Breach Toll at 8.2 Million - SecurityWeek cybersecurity Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys - The Hacker News threat-intel Cisco Patches Actively Exploited SSL VPN Vulnerability Affecting ASA and FTD Firewalls - GBHackers
1 / 15
All news ›
Cybersecurity

Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys

The Hacker News ·

Hackers exploited a critical Cisco Catalyst SD-WAN flaw, fixed in February, to plant custom malware inside the systems that control an organization's SD-WAN network. The malware, called KeyDrift, is designed to copy the keys that encrypt traffic between sites and store them for later use, Cisco Talos said on October 28. Talos calls the attacks historical but does not specify when they

Continue on The Hacker News ↗ ‹ All news Get the newsletter

The summary and image come from The Hacker News; the image is shown from their website.