Malware
KeyDrift
- First Reported
- Oct 29, 2026
- Latest Reported
- Oct 29, 2026
Reported Context (4)
- "UAT-11473 then installed a custom malware framework we track as 'KeyDrift' consisting of multiple components [like PolyFlame and LittleFilch] geared towards collecting sensitive keying information, acting as backdoors Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls
- Attackers planted KeyDrift malware on SD-WAN controllers Cisco SD-WAN Zero-Day Activity Overlaps With Volt Typhoon’s Silent Train Network
- The malware, called KeyDrift, is designed to copy the keys that encrypt traffic between sites and store them for later use, Cisco Talos said on October 28. Talos calls the attacks historical but does not specify when Cisco SD-WAN Flaw Exploited to Deploy Malware Designed to Steal Traffic Encryption Keys
- Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware Cisco SD-WAN Flaw Exploited to Deploy KeyDrift Malware
CVE (2)
Malware (3)
People (1)
Threat Actors (3)
MITRE ATT&CK (9)
Vendors (1)
Products (8)
Tools (2)
Industries (9)
Countries (2)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.