The malware on these SD-WAN controllers was not after files. It was after the keys that encrypt the traffic between branches
2026-10-30Security
Talos published KeyDrift on 28 October: a framework that hooks the SD-WAN daemon, lifts what it assesses to be AES-256 data-plane key material, and takes its orders over the control plane itself. The way in was patched in February.