Cisco Systems has fallen victim to voice phishing attacks that ultimately allowed hackers to publish stolen files on the dark web, Cisco disclosed on August 10, 2022. The fallout appears minimal, but the cyberattack reinforces that humans typically remain the weak link in effective cybersecurity practices.
It is believed by Cisco that the hackers linked to the UNC2447 cybercrime gang, Lapsus$ threat actor group, and Yanluowang ransomware operators.
Earlier Lapsus$ cyberattack victims included Globant, Microsoft Azure, Nvidia, Okta, Samsung and T-Mobile.
No ransomware has been observed or deployed, and Cisco has successfully blocked attempts to access the company’s network since discovering the incident, Cisco indicated. There has been no impact on its products, services, customer data, sensitive employee information, intellectual property or supply chain operations, Cisco added.
A Talos blog provides more knowledge into the incident, whose roots may extend back to May 24, 2022. On that date, Cisco became aware of a potential compromise. During the investigation, Cisco said it discovered:
- A Cisco employee’s credentials were compromised after an attacker gained control of a personal Google account where credentials saved in the victim’s browser were being synchronized.
- The attacker conducted a series of sophisticated voice phishing attacks under the guise of various trusted organizations attempting to convince the victim to accept multi-factor authentication (MFA) push notifications initiated by the attacker. The attacker ultimately succeeded in achieving an MFA push acceptance, granting them access to VPN in the context of the targeted user.
Your business could be at risk if you do not take your cybersecurity seriously. Let Reis Informatica help you and your business handle your security needs so you can focus on the important stuff! Schedule a complimentary business systems assessment today!
Source:
https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html
