- Cisco disclosed a breach by the Yanluowang ransomware group in the middle of August this year, stating that they had stolen 2.75 GB of data.
- Now, the ransomware gang leaks the stolen data on the dark web; Cisco confirms that those are actual data from the company.
- Yanluowang ransomware gang claims they have 55 GB of data, including some company secrets, but they do not provide any proof.
The networking technologies company, Cisco, has been in trouble with the Yanluowang ransomware group since May 2022. In that month, the threat actors managed to breach Cisco’s network. Then in August, the company announced that its systems were breached and employee credentials were compromised.
Cisco confirms the data
The company had previously stated that the ransomware gang have stolen 2.75 GB of data. However, the group claims they have 55 GB of data, including classified documents, technical schematics, and source codes. Now, the report related to the incident that was published on the Cisco Talos Intelligence Group page has a new update that states the following:
« On September 11, 2022, the bad actors who previously published a list of file names from this security incident to the dark web, posted the actual contents of the same files to the same location on the dark web. The content of these files matches what we already identified and disclosed.
Our previous analysis of this incident remains unchanged; we continue to see no impact on our business, including Cisco products or services, sensitive customer data or sensitive employee information, intellectual property, or supply chain operations. »
Additionally, Cisco has said they have no evidence suggesting that hackers managed to steal more than the company already disclosed; which means Yanluowang could be bluffing with source codes, technical schematics, and classified documents. The ransomware group did not provide any proof that they have 55 GB of data as well.
The timeline of the Cisco – Yanluowang incident is summarized as follows:
- On May 24, 2022, Cisco became aware of a potential compromise. Since that point, Cisco Security Incident Response (CSIRT) and Cisco Talos have been working to remediate.
- During the investigation, it was determined that a Cisco employee’s credentials were compromised after an attacker gained control of a personal Google account where credentials saved in the victim’s browser were being synchronized.
- The attacker conducted a series of sophisticated voice phishing attacks under the guise of various trusted organizations attempting to convince the victim to accept multi-factor authentication (MFA) push notifications initiated by the attacker. The attacker ultimately succeeded in achieving an MFA push acceptance, granting them access to VPN in the context of the targeted user.
- CSIRT and Talos are responding to the event and they have not identified any evidence suggesting that the attacker gained access to critical internal systems, such as those related to product development, code signing, etc.
- After obtaining initial access, the threat actor conducted a variety of activities to maintain access, minimize forensic artifacts, and increase their level of access to systems within the environment.
- The threat actor was successfully removed from the environment and displayed persistence, repeatedly attempting to regain access in the weeks following the attack; however, these attempts were unsuccessful.
- Cisco assesses with moderate to high confidence that this attack was conducted by an adversary that has been previously identified as an initial access broker (IAB) with ties to the UNC2447 cybercrime gang, Lapsus$ threat actor group, and Yanluowang ransomware operators.