Attackers broke into the controllers that run organizations' Cisco Catalyst SD-WAN estates by exploiting a critical vulnerability the vendor had already fixed in February, then planted custom malware designed to siphon off inter-site encryption keys — a campaign Cisco Talos revealed on 28 October.
The implant, tracked as KeyDrift, copies the cryptographic keys that protect traffic flowing between sites and stashes them for later use, handing an intruder the ability to read data that victims believe is still encrypted. Talos characterised the intrusions as "historical" without saying when they took place, how many organizations were affected, or how the attackers got in initially. Cisco says the underlying flaw is patched, but in the material reviewed for this report the company has not published a CVE identifier, affected version range, CVSS score or exploitation vector alongside the Talos write-up.
Why the timeline matters
The headline-grabbing element here is the key-stealing malware. The operationally significant element is the calendar.
The vulnerability was remediated in February. The public research landed on 28 October. In between lay roughly eight months — a window in which a critical flaw in a widely deployed network-control platform sat unfixed at any organization that had not been watching the February advisory closely. Patch latency, not patch availability, was the exposure.
Teams that applied the February fix promptly are unlikely to have been reachable. Those that did not should treat the flaw as live for a long stretch of the year and check accordingly.
Where the compromise sits
This is not a story about compromised branch routers. The intrusion targets the management plane — the controllers that hold the SD-WAN estate together — and that changes both the blast radius and the detection problem.
Controller-level access hands an attacker a map of the entire overlay: site topology, policy configuration, credentials, and, in this case, the keys that encrypt traffic between sites. An implant resident on the controller can quietly harvest material that stays useful long after the original foothold is closed.
That is why KeyDrift matters as a persistence mechanism rather than a destructive one. It is built to preserve access to data, not to interrupt operations — so teams waiting for outages, ransom notes or failed tunnels as a tripwire will be waiting too long. Detection has to be proactive.
Action checklist
For infrastructure and security teams — including Hong Kong organizations running Cisco Catalyst SD-WAN — a practical response sequence:
- Verify patch status against the advisory itself. Check each controller directly against the February fix rather than trusting change records, change tickets or institutional memory. Treat "we were probably not targeted" as a hypothesis to test, not a conclusion.
- Inspect controller hosts for the unexpected. Look for anomalous processes, unfamiliar scheduled tasks and modified system files, and pull indicators of compromise from the Talos advisory rather than secondary summaries.
- Re-key the overlay after patching. Patching closes the foothold but does not invalidate keys already stolen. If a controller may have been exposed during the unpatched window, re-key the overlay and re-establish tunnels so harvested material cannot decrypt future traffic.
- Audit management-plane access. Review who and what can reach the controllers, including API tokens, service accounts and automation credentials that rarely appear in routine access reviews.
- Tie advisories to a remediation SLA. Map vendor security advisories for network infrastructure to a defined remediation timeline, so a February fix never becomes an October incident.
What is still unknown
Talos has not disclosed the exploitation vector, the timeframe of the intrusions, the number or profile of victims, or the initial access method, and Cisco's public material as covered by The Hacker News on 28 October does not fill in those gaps. Whether Hong Kong organizations running Catalyst SD-WAN were among those hit cannot be determined from the published material either.
Defenders should therefore work from the primary Talos advisory directly for CVE numbers, affected versions and indicators before finalising detection rules — and should revisit this report if Talos later publishes the missing campaign detail.
Source: The Hacker News, 28 October 2026. Detection details and indicators: Cisco Talos advisory.
攻擊者利用廠商早於二月已修補的重大漏洞，入侵負責運作各機構 Cisco Catalyst SD-WAN 環境的控制器，再植入專門竊取站點之間加密金鑰的自訂惡意軟件——Cisco Talos 於 10 月 28 日披露了這項攻擊行動。
代號為 KeyDrift 的植入程序會複製保護站點之間流量的加密金鑰並將其儲存，供日後使用，令入侵者得以讀取受害方仍以為處於加密狀態的數據。Talos 將相關入侵形容為「歷史性」事件，但沒有說明事件發生時間、受影響機構數目，或攻擊者最初的入侵途徑。Cisco 表示底層漏洞已修補，但在本次報道所審閱的材料中，公司並未隨 Talos 的報告公布 CVE 編號、受影響版本範圍、CVSS 評分或漏洞利用方式。
時間線為何關鍵
最受關注的是竊取金鑰的惡意軟件，但從營運角度而言，關鍵在於日曆上的時間差。
漏洞於二月修補，公開研究於 10 月 28 日發表，其間相隔約八個月——在這段期間，任何沒有密切留意二月安全通告的機構，其廣泛部署的網絡控制平台均存在未修補的重大漏洞。真正的風險來自修補滯後，而非修補是否已經提供。
及時應用二月修補的團隊，遭到入侵的可能性較低；未有跟進的機構，則應在年內相當長的時間內將該漏洞視為仍然活躍，並據此進行檢查。
入侵範圍所在
這並非分支路由器被入侵的故事。攻擊針對的是管理平面——即維繫整個 SD-WAN 環境的控制器——這同時改變了影響範圍與偵測難度。
取得控制器層面的存取權，等於獲得整個 overlay 的完整藍圖：站點拓撲、policy 設定、憑證，以及本案中用於加密站點之間流量的金鑰。駐留在控制器上的植入程序，可在原始立足點被封堵後，繼續靜默蒐集長久有用的材料。
正因如此，KeyDrift 的重要性在於作為 persistence 機制，而非破壞性工具。它的設計目的是保住對數據的存取，而非中斷運作——依賴服務中斷、勒索訊息或 tunnel 失效作為警號的團隊，將會等待太久。偵測必須採取主動方式。
行動清單
面向基建及安全團隊——包括運行 Cisco Catalyst SD-WAN 的香港機構——的實際應對步驟：
- 直接根據安全通告核實修補狀態。逐一將每部 controller 對照二月修補進行核實，不要依賴變更記錄、變更工單或機構記憶。應將「我們大概不是目標」視為有待驗證的假設，而非既定結論。
- 檢查 controller 主機有無異常。留意異常程序、不熟悉的 scheduled tasks 及被修改的系統檔案，並從 Talos 安全通告直接取得 indicators of compromise，而非依賴二手摘要。
- 修補後重新設定 overlay 金鑰。修補封堵了立足點，但不會令已被竊取的金鑰失效。若 controller 在未修補期間可能曾暴露，應重新設定 overlay 金鑰並重建 tunnel，令被蒐集的材料無法解密日後的流量。
- 審計管理平面的存取權限。檢視哪些人及哪些系統可以連線至 controller，包括 API token、service account 及很少在例行存取審查中出現的自動化憑證。
- 為安全通告訂立 remediation SLA。將網絡基建的廠商安全通告對應至明確的修補時間表，確保二月的修補不會演變成十月的事故。
仍然未知的事項
Talos 尚未披露漏洞利用方式、入侵時段、受害者數目或特徵，以及初始存取方法；而 The Hacker News 於 10 月 28 日報導的 Cisco 公開材料亦未填補這些空白。運行 Catalyst SD-WAN 的香港機構是否在受襲之列，同樣無法從已公布材料中確定。
因此，防禦方在制定偵測規則前，應直接依據 Talos 原始安全通告取得 CVE 編號、受影響版本及 indicators——並在 Talos 日後公布缺失的行動詳情時，重新檢視本報告。
來源：The Hacker News，2026 年 10 月 28 日。偵測詳情及 indicators：Cisco Talos 安全通告。