Cisco disclosed on Wednesday that its corporate network was accessed by cyber-criminals in May after an employee’s personal Google account was compromised – an act a ransomware gang named “Yanluowang” has now claimed as its work.
A Cisco statement asserts the company “Did not identify any impact to [its] business as a result of this incident, including Cisco products or services, sensitive customer data or sensitive employee information, intellectual property, or supply chain operations.”
Cisco Security Incident Response and the company’s cybersecurity intelligent group Cisco Talos specified the only successful data exfiltration was from an account with cloud storage locker Box that was associated with a compromised employee’s account.
The attacker did manage to spend some time inside Cisco’s IT. According to Talos’s post, the attacker obtained access to Cisco networks, enrolled a series of devices for MFA and authenticated successfully to the Cisco VPN. The attacker “Then escalated to administrative privileges, allowing them to login to multiple systems.” That action alerted the Cisco Security Incident Response Team, which swooped in with “Extensive IT monitoring and remediation capabilities” to “Implement additional protections, block any unauthorized access attempts, and mitigate the security threat.” Efforts were also made to improve “Employee cybersecurity hygiene.”
The attacker then employed voice-phishing techniques that saw operatives call using various accents and posing as various trusted organizations, seeking to help the Cisco staffer, until he or she cracked and accepted a bogus MFA notification that gave the hackers access to the VPN. Once inside, they spread laterally to Citrix servers – eventually obtaining privileged access to domain controllers.
The attacker then attempted to establish email communication with Cisco execs, showing off directory listings of their loot – an alleged 2.75GB of data containing around 3,700 files – and suggesting Cisco could pay to avoid disclosure.
