Cisco Talos has disclosed that attackers exploited a critical vulnerability in Cisco Catalyst SD-WAN devices to install custom malware called KeyDrift. According to Cisco Talos, the malware was built to copy encryption keys used to protect traffic between network sites and store them for later use. Cisco said the underlying flaw had already been fixed in February, and described the attacks as historical.

What happened

The reported incident involves Cisco Catalyst SD-WAN systems, which many organisations use to connect offices, cloud environments and remote locations over managed wide-area networks. Cisco Talos said attackers used a critical flaw in these systems to deploy malware inside the infrastructure that controls the SD-WAN environment.

Talos identified the malware as KeyDrift. Its stated purpose was to collect encryption keys used for securing traffic between sites. While Talos described the attacks as historical, the disclosure did not specify when the compromises took place or how many organisations were affected.

What is confirmed from the report is that the attackers targeted network infrastructure rather than end-user devices, and that the vulnerability used in the attacks had already been patched earlier this year.

Why it matters for European businesses

This is relevant because SD-WAN sits in a sensitive part of business infrastructure. It often carries traffic between offices, warehouses, cloud workloads, remote users and business-critical applications. If attackers gain access at that layer, the impact can extend beyond a single server or employee account.

The detail that matters most is the theft of encryption keys. If an attacker is able to obtain keys used to protect site-to-site traffic, the risk is not limited to the initial device compromise. Businesses may also need to consider whether keys, certificates or related trust relationships should be replaced, depending on their network design and the vendor guidance available.

For European companies, this matters especially where SD-WAN supports cross-border operations, e-commerce platforms, branch networks, logistics sites or regulated data flows. A compromise of edge networking equipment can affect availability, confidentiality and incident response obligations.

The case also underlines a broader operational lesson: patching internet-facing and edge infrastructure quickly is essential, but patching alone may not be enough if exploitation happened before the update was applied. In some cases, organisations may need to check for persistence, review device integrity and rotate sensitive material after remediation.

Who may be affected

• Businesses using Cisco Catalyst SD-WAN in branch, hybrid cloud or multi-site environments
• Retail and e-commerce operators connecting stores, warehouses and central systems over SD-WAN
• Manufacturing, logistics and distributed service organisations that rely on secure site-to-site connectivity
• IT and network teams responsible for edge infrastructure, VPNs and device lifecycle management
• Regulated organisations where network compromise could raise security, audit or reporting concerns

What companies should consider

• Confirm patch status: Verify whether affected Cisco SD-WAN systems were updated with the February fix and check for any additional vendor guidance or indicators of compromise.
• Review for historical compromise: Because Cisco described the activity as historical, organisations should consider whether there is a need to inspect logs, management access records and device changes going back before the patch date.
• Assess key and credential exposure: If there is evidence of compromise, review whether encryption keys, certificates, admin credentials or related secrets may need rotation or replacement.
• Inspect edge infrastructure more broadly: Treat routers, SD-WAN controllers, firewalls and VPN appliances as high-priority assets for vulnerability management and monitoring.
• Check segmentation and monitoring: Ensure management interfaces are restricted, logging is enabled and unusual administrative activity on network devices is reviewed promptly.
• Align incident response plans: Companies with multiple sites or regulated operations should make sure network-device compromise scenarios are covered in response procedures, including escalation to suppliers or managed service providers where relevant.

For SMEs and mid-sized organisations, the practical takeaway is straightforward: internet-facing network infrastructure should be patched quickly, but businesses should also plan for post-compromise steps if attackers may have had access before a fix was applied.