Technology giant Cisco has admitted suffering a security incident targeting its corporate IT infrastructure in late May 2022.
On August 10, the vendor stated that an employee’s credentials were compromised after an attacker gained control of a personal Google account where credentials saved in the victim’s browser were being synchronised. Bad actors published a list of files from this security incident to the dark web, Cisco added.
“The incident was contained to the corporate IT environment and Cisco did not identify any impact to any Cisco products or services, sensitive customer data or employee information, Cisco intellectual property, or supply chain operations,” the company said.
Cisco claimed it took immediate action to contain and eradicate the bad actor, which it has linked to notorious threat group Lapsus$. It also said that it has taken the decision to publicly announce the incident now as it was previously actively collecting information about the bad actor to help protect the security community.
Attacker used “sophisticated voice phishing” tactics
In an executive summary of the incident, Cisco Security Incident Response (CSIRT) and the company’s cyber security intelligent group Cisco Talos wrote “the attacker conducted a series of sophisticated voice phishing attacks under the guise of various trusted organisations attempting to convince the victim to accept multi-factor authentication (MFA) push notifications initiated by the attacker.
"The attacker ultimately succeeded in achieving an MFA push acceptance, granting them access to VPN in the context of the targeted user."
CSIRT and Talos have not identified any evidence suggesting that the attacker gained access to critical internal systems, such as those related to product development and code signing, they added. After obtaining initial access, the threat actor conducted activities to maintain access, minimise forensic artifacts, and increase their level of access to systems within the environment.
“The threat actor was successfully removed from the environment and displayed persistence, repeatedly attempting to regain access in the weeks following the attack. However, these attempts were unsuccessful.”
Attack linked to Lapsus$ threat group
Cisco assessed with “moderated to high confidence” that this attack was conducted by an adversary that has been previously identified as an initial access broker (IAB) with ties to the UNC2447 cyber crime gang, Lapsus$ threat actor group, and Yanluowang ransomware operators.
“UNC2447 is a financially motivated threat actor with a nexus to Russia that has been previously observed conducting ransomware attacks and leveraging a technique known as ‘double extortion,’ in which data is exfiltrated prior to ransomware deployment to coerce victims into paying ransom demands.
Prior reporting indicates that UNC2447 has been observed operating a variety of ransomware, including FIVEHANDS, HELLOKITTY, and more.”
However, Cisco stated that no ransomware has been observed or deployed in the attack.
“Every cyber security incident is an opportunity to learn, strengthen our resilience, and help the wider security community," the vendor stated. "Cisco has updated its security products with intelligence gained from observing the bad actor’s techniques, shared indicators of compromise (IOCs) with other parties, reached out to law enforcement and other partners."
Cisco has implemented a company-wide password reset upon learning of the incident.
Strengthen MFA, device verification and network segmentation to mitigate risks
Cisco advised organisations to take steps to mitigate the risks associated with this incident, including strengthening MFA, device verification, and network segmentation.
“Given the actor’s demonstrated proficiency in using a wide array of techniques to obtain initial access, user education is also a key part of countering MFA bypass techniques," it added.
"Equally important to implementing MFA is ensuring that employees are educated on what to do and how to respond if they get errant push requests on their respective phones. It is also essential to educate employees about who to contact if such incidents do arise to help determine if the event was a technical issue or malicious.”
It is beneficial to implement strong device verification by enforcing stricter controls around device status to limit or block enrollment and access from unmanaged or unknown devices, Cisco added.
Network segmentation is another important security control that organisations should employ, as it provides enhanced protection for high-value assets and enables more effective detection and response capabilities in situations where an adversary is able to gain initial access into the environment, the firm said.
“Centralised log collection can help minimise the lack of visibility that results when an attacker takes active steps to remove logs from systems. Ensuring that the log data generated by endpoints is centrally collected and analysed for anomalous or overtly malicious behaviour can provide early indication when an attack is underway.”