Ransomware Gang Hacks Networking Giant, Cisco, Claims To Have 2.8GB Of Data

Ransomware Gang Hacks Networking Giant, Cisco, Claims To Have 2.8GB Of Data

Ransomware Gang Hacks Networking Giant, Cisco, Claims To Have 2.8GB Of Data

Ransomware gang hacks networking giant Cisco claiming to have access to 2.8GB of data as group publishes a partial list of files it claims to have exfiltrated.

On the same day that the Yanluowang ransomware group published a partial list of files it says were stolen from Cisco, the networking giant’s Talos Intelligence Group confirmed that Cisco had, indeed, been hacked.

The confirmation, that came by way of a Talos blog posting, stated Cisco was first made aware of a potential compromise on May 24. The potential compromise became a confirmed network breach following further investigation by the Cisco Security Incident Response (CSIRT) team.

Who is behind the Cisco hack?

Cisco said that the initial access vector was through the successful phishing of an employee’s personal Google account, which ultimately led to the compromise of their credentials and access to the Cisco VPN.

The threat actor, confirmed as an initial access broker with ties to a Russian group called UNC2447 as well as the Yanluowang ransomware gang was ejected from the network and prevented from re-entry despite many attempts over the following weeks. The tactics, techniques, and procedures (TTPs) also showed some overlap with the Lapsus$ group, many of whom were arrested earlier in the year.

No ransomware deployed, Cisco says

Importantly, Cisco says that there was no ransomware deployment during the attack that it could find. CSIRT has stated “Cisco did not identify any impact to our business as a result of this incident, including no impact to any Cisco products or services, sensitive customer data or sensitive employee information, Cisco intellectual property, or supply chain operations. On August 10 the bad actors published a list of files from this security incident to the dark web.”

A company-wide password reset was initiated after the breach and is to be praised for the clear and detailed disclosures it has made regarding the technicalities of the hack.

Related posts

Leave a Comment