> TritonInfoSec News
Home / Oct 30, 2026 / Story
0
#10 The Hacker News general October 29, 2026 at 08:24 UTC

Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys

By [email protected] (The Hacker News)

AI Summary

Cisco Talos detailed how threat actors exploited a critical vulnerability in Cisco Catalyst SD-WAN Controllers — patched in February — to deploy custom malware called KeyDrift, which is engineered to exfiltrate the encryption keys protecting inter-site SD-WAN traffic. The stolen keys would allow attackers to decrypt captured network traffic retroactively. Talos linked the attack infrastructure to Volt Typhoon's Silent Train relay network, suggesting Chinese state-sponsored involvement in targeting enterprise WAN encryption.

Read full article → https://thehackernews.com/2026/10/hackers-exploite…

Relevance score: 78.0/100

# More from October 30

  1. 1
    Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen The Hacker News
  2. 2
    New Cisco firewall zero-day exploited to crash SSL VPN devices BleepingComputer
  3. 3
    Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network SecurityWeek
  4. 4
    Volt Typhoon hides zero-day attacks using 'Silent Train' framework BleepingComputer
  5. 5
    Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces The Hacker News
  6. 6
    China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility The Hacker News
  7. 7
    Chrome extensions with 13.4 million installs caught hijacking searches BleepingComputer
  8. 8
    Massive leak exposes 41,000 DHS workers and undercover ICE agents Ars Technica Security
  9. 9
    Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls The Hacker News