CISA | Cisco Hacked: Ransomware Gang Claims It Has 2.8GB Of Data

Davey WinderSenior Contributor | Co-founder, Straight Talking Cyber

Networking giant Cisco confirms hacking as ransomware group publishes a partial list of files it claims to have exfiltrated.

On the same day that the Yanluowang ransomware group published a partial list of files it says were stolen from Cisco, the networking giant's Talos Intelligence Group confirmed that Cisco had, indeed, been hacked.

The confirmation, that came by way of a Talos blog posting, stated Cisco was first made aware of a potential compromise on May 24. The potential compromise became a confirmed network breach following further investigation by the Cisco Security Incident Response (CSIRT) team.

Who is behind the Cisco hack?

Cisco said that the initial access vector was through the successful phishing of an employee’s personal Google account, which ultimately led to the compromise of their credentials and access to the Cisco VPN.

The threat actor, confirmed as an initial access broker with ties to a Russian group called UNC2447 as well as the Yanluowang ransomware gang was ejected from the network and prevented from re-entry despite many attempts over the following weeks. The tactics, techniques, and procedures (TTPs) also showed some overlap with the Lapsus$ group, many of whom were arrested earlier in the year.

No ransomware deployed, Cisco says

Importantly, Cisco says that there was no ransomware deployment during the attack that it could find. CSIRT has stated "Cisco did not identify any impact to our business as a result of this incident, including no impact to any Cisco products or services, sensitive customer data or sensitive employee information, Cisco intellectual property, or supply chain operations. On August 10 the bad actors published a list of files from this security incident to the dark web."

A company-wide password reset was initiated after the breach and is to be praised for the clear and detailed disclosures it has made regarding the technicalities of the hack.

I will update this article as more information becomes known.

LEARN MORE