Network controllers targeted for keys and long-term strategic access
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Friday, October 30th, 2026.
Attackers exploited Cisco SD-WAN controllers to gain privileged access and install malware designed for persistence and key theft. The KeyDrift framework operated inside legitimate control-plane processes, intercepted decrypted traffic and collected material believed to protect data-plane communications. The campaign targeted organizations involved in space, satellites, defense, aerospace and policy research. Its infrastructure significantly overlapped with a covert network used by Volt Typhoon, but researchers didn’t conclude that the operators were the same group.
This matters because compromising a network controller can expose far more than one device. It can affect traffic and configuration across the wider environment. For leaders, control-plane systems should receive the same scrutiny as identity infrastructure. For defenders, patch the affected controllers, apply the vendor’s hardening guidance and investigate for persistence rather than assuming an update removes an established intruder. The targeting points to intelligence collection and preparation for longer-term access.
Patch and harden SD-WAN controllers, then review them for rogue peers, altered startup scripts and unexplained key access.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
