Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys

thehackernews.com Oct 29, 2026

Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys

Curated by Shubham · TechCapsules · Oct 29, 2026

AI-summarised brief · reviewed before publication

Cisco disclosed a critical SD‑WAN flaw (CVE‑2026‑20127) that allows unauthenticated attackers to bypass authentication and gain administrative privileges on Catalyst SD‑WAN controllers. Exploited by a group linked to Volt Typhoon, the attackers deployed custom malware, KeyDrift, which infiltrates the controller’s vdaemon process, extracts AES‑256 encryption keys, encrypts them with RSA, and exfiltrates the data over UDP. The vulnerability, rated CVSS 10.0, affects on‑premises and cloud‑hosted SD‑WAN deployments, and Cisco has released patches for affected software trains.

💡 Why It Matters

· The breach exposes the core encryption mechanism that secures inter‑site traffic, potentially allowing attackers to decrypt sensitive data across an organization’s entire network.
· This undermines the foundational trust model of SD‑WAN architectures and signals a broader threat to critical infrastructure sectors.

Capsules Cybersecurity

Read full article on thehackernews.com

GitHub Launches npm Firewall to Block Malicious Packages Before Installation

GitHub announced a preview package firewall that blocks suspicious npm packages at install time. The firewall, available to all GitHub Enterprise Cloud customers, sits between endpoints or internal registries and upstream repositories, inspecting metadata and downloads for malicious activity. Administrators configure policy controls, such as a minimum package age cooldown ranging from 1 to 365 days, and can request exceptions for blocked packages. The feature aims to protect automated CI/CD pipelines and AI agents from malware introduced through newly published dependencies.

💡 By enforcing a cooldown period, the firewall gives security teams critical time to detect and respond to malicious releases before they propagate through automated build processes.

techcrunch.com · Oct 29

Hacker stole personnel data about thousands of Homeland Security employees, including CBP…

A hacker using the alias “Department of Peace” released personal data for more than 40,000 U.S. Department of Homeland Security (DHS) employees after extracting it from an Okta single sign‑on system earlier this year. The leak includes names, job titles, email addresses, phone numbers and office locations for staff across DHS agencies, notably 21,000 Customs and Border Protection workers, 10,000 Immigration and Customs Enforcement personnel, and nearly 1,000 Cybersecurity and Infrastructure Security Agency employees. The dataset also contains login records that reveal which internal applications each user could access. The breach, verified by TechCrunch and posted to DDoSecrets, follows two prior DHS incidents and comes amid heightened scrutiny of the department’s immigration enforcement ahead of the midterm elections. DHS confirmed awareness of a “potential breach” and is investigating; Okta said it sees no evidence its systems were compromised.

💡 The exposure of authentication details gives threat actors a roadmap to infiltrate critical immigration and border‑security systems, raising immediate national‑security concerns.

thehackernews.com · Oct 29

Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash…

Cisco issued patches for a high‑severity flaw (CVE‑2026‑76418) in its Secure Firewall ASA and FTD software that has been actively exploited. The vulnerability, rated 8.6 on CVSS, allows unauthenticated remote attackers to trigger a device reload via the SSL VPN, causing a denial‑of‑service. Cisco identified the issue in October 2026, linked it to logic errors in secondary authentication on tunnel groups, and released fixes for affected versions. Temporary mitigations include disabling tunnel‑group lists or secondary authentication on default groups.

💡 The flaw exposes critical network infrastructure to remote DoS attacks, threatening uptime for sectors that rely on Cisco firewalls for secure connectivity. Prompt patching is essential to prevent service disruptions in high‑risk environments.

thehackernews.com · Oct 29

FBI Seizes Virtualine Domain Over Alleged Criminal Hosting and Bitcoin Money Laundering

The U.S. Department of Justice announced the seizure of the Virtualine domain, a bulletproof hosting provider used for child sexual abuse material, nonconsensual intimate content, and Bitcoin money laundering. The FBI, alongside international law‑enforcement partners, seized the site after Virtualine continued to host a criminal forum, Vendor 1, despite repeated abuse notices. Virtualine offered paid plans, accepted unhosted Bitcoin payments, and allegedly laundered funds for cybercriminals. The operator issued a rebuttal letter following the seizure.

💡 This action disrupts a key infrastructure hub that enables the distribution of illegal content and the laundering of illicit funds, tightening the net around cybercriminal operations worldwide.

thehackernews.com · Oct 29

Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns

Volt Typhoon, a China‑linked espionage group, has been linked to a covert access network called Silent Train that enabled four zero‑day exploitation campaigns. Discovered in late 2023, Silent Train strings together compromised SOHO, IoT and enterprise devices in rapidly rotating, one‑time‑use chains that relay malicious traffic and are dismantled after each operation. The model uses anti‑forensic techniques and multi‑hop relays to hide origins, allowing the group to exploit vulnerabilities, harvest credentials, exfiltrate data and maintain long‑term footholds. Researchers identified hundreds of victims across telecoms, government, defense, satellite, water, energy, transportation and emergency services, with more than 30 confirmed victims in the latest campaign. The group previously leveraged a Versa Director zero‑day (CVE‑2024‑39717) and is suspected of a Quest KACE zero‑day patched in October 2025 so far.

💡 By weaponizing everyday consumer gear, Volt Typhoon demonstrates that even mundane devices can become launch pads for state‑sponsored attacks, forcing defenders to rethink perimeter security across all network layers.

thehackernews.com · Oct 29

American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed

A new phishing campaign, Skyw4lker, targets U.S. manufacturing, technology, and healthcare firms by sending password‑protected business documents that lure victims into a legitimate Microsoft device‑authorization flow. The attackers host the documents on Google sites, then redirect users to Microsoft authentication, where the victim unknowingly grants access tokens. ANY.RUN’s sandbox analysis revealed obfuscated JavaScript, a PHP backend, and repeated polling to capture IP and geolocation data. The FBI’s 2024 complaint data shows phishing remains the most reported internet crime, underscoring the campaign’s relevance.

💡 By exploiting legitimate authentication flows, Skyw4lker bypasses traditional credential‑stealing defenses, forcing security teams to adopt behavioral analysis and interactive sandboxes to detect and mitigate such subtle attacks.