Cisco Systems has suffered voice phishing attacks that ultimately allowed hackers to publish stolen files on the dark web, Cisco disclosed on August 10, 2022. In many ways, the fallout appears minimal. But the cyberattack reinforces that humans typically remain the weak link in effective cybersecurity practices.
Cisco believes the attack was conducted by hackers linked to the UNC2447 cybercrime gang, Lapsus$ threat actor group, and Yanluowang ransomware operators.
Earlier Lapsus$ cyberattack victims included Globant, Microsoft Azure, Nvidia, Okta, Samsung and T-Mobile.
On the upside for Cisco: No ransomware has been observed or deployed, and Cisco has successfully blocked attempts to access the company's network since discovering the incident, Cisco indicated. Moreover, the company has not seen any impact to its products, services, customer data, sensitive employee information, intellectual property or supply chain operations, Cisco added.
Cisco Cyberattack: How Google Account Was Compromised
A Talos blog provides deeper technical details on the incident, whose roots may extend back to May 24, 2022. On that date, Cisco became aware of a potential compromise. During the investigation, Cisco said it discovered:
- A Cisco employee’s credentials were compromised after an attacker gained control of a personal Google account where credentials saved in the victim’s browser were being synchronized.
- The attacker conducted a series of sophisticated voice phishing attacks under the guise of various trusted organizations attempting to convince the victim to accept multi-factor authentication (MFA) push notifications initiated by the attacker. The attacker ultimately succeeded in achieving an MFA push acceptance, granting them access to VPN in the context of the targeted user.
Voice-oriented phishing attacks are not new. For instance, cybercriminals used fake voicemail messages to lure victims into entering their Microsoft Office 365 email credentials as part of a 2019 phishing campaign, MSSP Alert reported at the time.
Meanwhile, Cisco Continues MSP Security Push
The Cisco-oriented attacks come as the networking giant strives to accelerate growth in its own security business. The company in May 2022 overhauled the structure of its security business. Early results of the reorg may surface in Cisco's next quarterly earnings report, which is scheduled to surface on August 17, 2022.
For MSPs, Cisco continues to promote such services as Duo for multi-factor authentication and Umbrella for DNS and SASE-oriented security. Also, the Cisco Secure MSP portal is emerging as a single pane of glass for partners to source Cisco's cloud-based security solutions.
