Cisco Suffers Cyber Attack By UNC2447, Lapsus$, & Yanluowang

• Cisco confirmed that the UNC2447 cybercrime gang, Lapsus$ threat actor group, and Yanluowang ransomware operators breached its corporate network in late May and that the actor tried to extort them under the threat of leaking stolen files online.
• During the investigation, it was determined that a Cisco employee’s credentials were compromised after an attacker gained control of a personal Google account where credentials saved in the victim’s browser were being synchronized.
• The attacker conducted a series of sophisticated voice phishing attacks under the guise of various trusted organizations attempting to convince the victim to accept multi-factor authentication (MFA) push notifications initiated by the attacker. The attacker ultimately succeeded in achieving an MFA push acceptance, granting them access to VPN in the context of the targeted user.
• After obtaining initial access, the threat actor conducted a variety of activities to maintain access, minimize forensic artifacts, and increase their level of access to systems within the environment.

Vishing is a common social engineering technique where attackers try to trick employees into disclosing sensitive information over the phone.

MFA fatigue is an attack where criminals target a user’s MFA application for account access by sending multiple push requests to the target device until user accidentally or on purpose allow one of the repeated push notifications they are receiving.

After attackers successfully authenticated to Cisco VPN service, they had escalated from regular user privilege to administrative privileges, which allowed them to log in to multiple systems inside Cisco’s corporate network.