Cisco
Company Details
Linkedin ID:
cisco
Website:
Employees number:
95,475
Number of followers:
7,252,763
NAICS:
5112
Industry Type:
Homepage:
cisco.com
IP Addresses:
1
Company ID:
CIS_2976377
Scan Status:
Completed
Cisco Company CyberSecurity Posture
cisco.com
Cisco is the worldwide technology leader that is revolutionizing the way organizations connect and protect in the AI era. For more than 40 years, Cisco has securely connected the world. With its industry leading AI-powered solutions and services, Cisco enables its customers, partners and communities to unlock innovation, enhance productivity and strengthen digital resilience. With purpose at its core, Cisco remains committed to creating a more connected and inclusive future for all.
Cisco A.I CyberSecurity Scoring
Cisco Risk Score (AI oriented)Between 600 and 649
Cisco
Updated:
- Powered by our proprietary A.I cyber incident model
- Insurance preferes TPRM score to calculate premium
Cisco Global Score (TPRM)XXXX
Cisco
- Instant access to detailed risk factors
- Benchmark vs. industry & size peers
- Vulnerabilities
- Findings
Cisco Company CyberSecurity News & History
Past Incidents
17
Attack Types
5
Cisco Systems, Inc.
Breach
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: The California Office of the Attorney General reported on October 25, 2016, that Cisco Systems, Inc. experienced a data breach on August 18, 2016. The breach involved a security setting error on the Cisco Professional Careers mobile website, potentially exposing job application-related personal information including names, addresses, emails, phone numbers, and other sensitive data. Approximately individuals were affected.
Cisco
Breach
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: A former Cisco employee accessed the company's cloud infrastructure in 2018, five months after resigning, to deploy code that led to the shutdown of more than 16,000 WebEx Teams accounts and the deletion of 456 virtual machines. 30-year-old Sudhish Kasaba Ramesh accessed Cisco's cloud infrastructure hosted on Amazon Web Services without permission on September 24, 2018. The shutdown forced Cisco to spend more than $2,400,000 in customer refunds and employee time needed to restore the damage caused by Ramesh.
Cisco
Breach
Rankiteo Explanation
Attack threatening the organization's existence
Description: Cisco has was targeted in a data leaked by the Yanluowang ransomware gang in September 2022. The gang leaked the data that was stolen from the company network during a cyberattack in May. The stolen data included non-sensitive files from the employee’s Box folder and thousands of files amounting to 55GB and that the cache included classified documents, technical schematics, and source code.
Cisco
Cyber Attack
Rankiteo Explanation
Attack threatening the organization's existence
Description: Government cyber agencies globally, including Canada’s CSE and the U.S. CISA, have issued urgent warnings about a sophisticated **state-sponsored espionage campaign** (ArcaneDoor) exploiting vulnerabilities in **Cisco’s Adaptive Security Appliances (ASA)**, widely used for VPNs by remote workers and critical infrastructure. The attackers implanted malware, executed commands, and potentially **exfiltrated data** from compromised devices, targeting legacy systems with high evasion capabilities. The U.S. mandated federal agencies to patch vulnerabilities within 24 hours, labeling the threat as **significant risk to victim networks**. The UK’s NCSC noted the malware’s **evolution in sophistication**, while Cisco confirmed the actor’s focus on espionage. Critical sectors—governments, academia, and research facilities—were urged to act immediately. The attack’s scope remains under investigation, but its **advanced persistence mechanisms** and potential for **data theft from high-value targets** (e.g., state secrets, intellectual property) pose severe operational and national security risks. The campaign’s **targeting of VPN infrastructure** could enable lateral movement into broader networks, amplifying the threat to organizational integrity and confidentiality.
Cisco
Cyber Attack
Rankiteo Explanation
Attack that could bring to a war
Description: The **U.K. National Cyber Security Centre (NCSC)** disclosed that **state-sponsored threat actors (UAT4356/Storm-1849, linked to China)** exploited **zero-day vulnerabilities (CVE-2025-20362, CVE-2025-20333)** in **Cisco ASA 5500-X Series firewalls** to deploy **previously undocumented malware (RayInitiator, LINE VIPER)**. The attack targeted **multiple government agencies**, enabling **persistent access, command execution, data exfiltration, and forensic evasion** by modifying the **ROMMON bootloader** and disabling logging. The compromised devices—**end-of-support (EoS) models lacking Secure Boot**—were vulnerable to **full system takeover**, including **root-level arbitrary code execution**. The campaign demonstrated **advanced operational security**, with malware designed to **survive reboots, suppress syslogs, and bypass VPN authentication**. While no direct evidence confirmed **large-scale data breaches**, the **targeting of government infrastructure** and **use of nation-state tools** suggest **high strategic impact**, potentially threatening **national security, critical services, and diplomatic stability**. The attack’s **sophistication and persistence mechanisms** indicate a **long-term espionage or sabotage intent**, with risks extending beyond Cisco to **broader supply-chain and geopolitical consequences**.
Cisco
Cyber Attack
Rankiteo Explanation
Attack threatening the economy of geographical region
Description: Hackers, specifically the **ArcaneDoor** group linked to Russian state actors, exploited zero-day vulnerabilities (CVE-2024-20353 and CVE-2024-20359) in **Cisco’s Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)** software—critical components of U.S. federal cyber infrastructure. The breach, detected on **September 26, 2025**, allowed attackers to execute **remote denial-of-service (DoS) attacks** via infinite loops and **escalate privileges from administrator to root access**, compromising hundreds of Cisco firewall devices used by U.S. government agencies. Classified documents were stolen, including intelligence on **espionage, fraud, money laundering, and foreign agent activities**, directly threatening national security. The attack follows a 2024 pattern where Cisco’s systems were repeatedly targeted, with CISA issuing emergency directives to mitigate further damage. The incident underscores systemic vulnerabilities in federal cyber defenses, with experts warning of escalating threats as other cybercriminal groups adopt ArcaneDoor’s tactics.
Cisco
Data Leak
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: Cisco has addressed a security flaw that allowed personal data to leak from the company's Professional Careers portal. Cisco clarifies that just a small amount of information connected to job applications was stolen from the mobile version of the website in its email notification of the issue to the impacted individuals. As to the security alert distributed by Cisco to its users, an erroneous security configuration on a third-party site following system repair was the cause of data leaking. The information leaked by Cisco comprises personal details such as name, password, email address, phone number, security question answers, professional profile and educational background, cover letter, resume content, and other details.
Cisco
Ransomware
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: Cisco hacked by Yanluowang ransomware gang, 2.8GB allegedly stolen. The compromised information includes cisco products or services, sensitive customer data or sensitive employee information, intellectual property, or supply chain operations. A redacted NDA agreement that was obtained in the attack was also supplied to BleepingComputer by the threat actors as evidence of the incident and a "hint" that they had infiltrated Cisco's network and taken files. They immediately took action to contain and eradicate the bad actors.
Cisco
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: In May 2022, Cisco fell victim to a **Yanluowang ransomware attack** orchestrated by Aleksey Olegovich Volkov, an initial access broker (IAB) who breached the company’s network by compromising a **Cisco employee’s Box folder**. While the attackers exfiltrated **non-sensitive files**, they failed to encrypt Cisco’s systems or successfully extort a ransom. However, the incident exposed critical vulnerabilities in Cisco’s security posture, revealing that threat actors could infiltrate corporate networks, steal credentials, and potentially deploy ransomware. The attack was part of a broader campaign targeting at least **eight U.S. companies**, with Volkov selling network access to Yanluowang operators, who then demanded ransoms ranging from **$300,000 to $15 million**. Although Cisco avoided financial loss or data encryption in this instance, the breach underscored the risks of **supply-chain attacks, credential theft, and ransomware-as-a-service (RaaS) operations**. The FBI’s investigation later tied Volkov to **LockBit ransomware** as well, highlighting his role in facilitating high-impact cybercrime.
Cisco
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Cisco, a multinational technology conglomerate, was targeted by the **Yanluowang ransomware gang** in a sophisticated attack facilitated by Aleksey Volkov, an initial access broker. The group exploited network vulnerabilities to infiltrate Cisco’s systems, deploying ransomware that encrypted critical data and disrupted operations. While the article does not specify the exact financial or data losses Cisco incurred, the broader context of Yanluowang’s operations—including extortion demands, DDoS attacks, and threats to executives—suggests severe operational and reputational harm. The gang’s tactics often involved stealing sensitive corporate or customer data before encrypting systems, then demanding ransom payments under threat of public exposure or prolonged outages. Cisco’s inclusion among high-profile victims (alongside Walmart) underscores the attack’s strategic intent to cripple infrastructure and extract maximum financial gain. The involvement of a Russian national linked to defense ministry ties further elevates the attack’s geopolitical and cybersecurity significance, aligning with Yanluowang’s pattern of targeting Western enterprises with precision.
Cisco
Vulnerability
Rankiteo Explanation
Attack threatening the economy of a geographical region
Description: Cisco has released security patches for multiple vulnerabilities in its Small Business RV Series router platform. This vulnerability could allow any remote attacker to gain complete control over the device without authentication. The attacker could execute arbitrary code, elevate privileges, run commands, bypass authentication protections, and retrieve and execute unsigned software if exploits the flaw.
Cisco
Vulnerability
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Over **48,800 internet-exposed Cisco Adaptive Security Appliance (ASA) and Firewall Threat Defense (FTD) devices** remain vulnerable to two critical flaws (**CVE-2025-20333** and **CVE-2025-20362**), enabling **remote, unauthenticated arbitrary code execution** and unauthorized access to VPN endpoints. Exploitation began **before patches were available**, with threat actors deploying **shellcode loaders (Line Viper)** and **GRUB bootkits (RayInitiator)**. The U.S. **CISA issued an emergency directive**, mandating federal agencies to patch or disconnect affected devices within **24 hours**, while the **U.K.’s NCSC** confirmed active attacks. Despite warnings since **late August**, most exposed devices—primarily in the **U.S., U.K., Japan, and Germany**—remain unpatched, risking **full system compromise, lateral movement, and data exfiltration**. The lack of workarounds exacerbates the threat, leaving organizations vulnerable to **persistent access, malware deployment, and potential supply-chain attacks** if breached devices are used to pivot into corporate networks.
Cisco
Vulnerability
Rankiteo Explanation
Attack threatening the organization’s existence
Description: A severe vulnerability in Cisco's networking equipment, identified as CVE-2018-0171, has been exploited by attackers, notably by the APT group Salt Typhoon. Despite a patch released in 2018, over 1,200 devices remain unpatched, providing an attack surface for unauthorized remote code execution and configuration theft. The attack chiefly involves using the Smart Install feature to extract sensitive data from networking devices, exacerbating the risk of further infiltrations and potentially catastrophic network breaches. This enduring security oversight, which notably affected telecommunications providers, exemplifies the danger legacy systems pose to the current technology infrastructure.
Cisco
Vulnerability
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Cisco disclosed **CVE-2025-20265**, a **critical (CVSS 10.0) remote code execution (RCE) vulnerability** in its **Secure Firewall Management Center (FMC) Software**, affecting versions **7.0.7 and 7.7.0** when **RADIUS authentication** is enabled. The flaw stems from **improper input validation** during RADIUS credential processing, allowing **unauthenticated attackers** to inject and execute **arbitrary shell commands with high-level privileges** remotely. No authentication or user interaction is required, making it highly exploitable.The vulnerability poses a **severe risk** as it enables full system compromise, potentially leading to **lateral movement, data exfiltration, or complete takeover of firewall management infrastructure**. While no **public exploitation** has been reported yet, the lack of workarounds (beyond disabling RADIUS) and the **critical severity** demand **immediate patching**. Cisco has released fixes but warns that mitigation requires **disabling RADIUS**, which may disrupt operational workflows.The flaw was discovered internally, underscoring the **proactive threat** of unpatched enterprise firewall systems. Organizations failing to patch risk **catastrophic breaches**, including **unauthorized access to sensitive networks, credential theft, or downstream attacks on connected systems**.
Cisco
Vulnerability
Rankiteo Explanation
Attack threatening the organization's existence
Description: A security researcher has published a blog post demonstrating a complete exploit chain for CVE-2025-20281, a critical unauthenticated remote code execution vulnerability in Cisco Identity Services Engine (ISE). This vulnerability allows unauthenticated, remote attackers to upload arbitrary files to the target system and execute them with root privileges. The issue stems from unsafe deserialization and command injection in the enableStrongSwanTunnel() method. Although hotfixes were made available, Cisco urged users to update to 3.3 Patch 7 and 3.4 Patch 2 to address both vulnerabilities. On July 22, 2025, Cisco marked both CVE-2025-20281 and CVE-2025-20337 as actively exploited in attacks, urging admins to apply the security updates as soon as possible.
Cisco
Vulnerability
Rankiteo Explanation
Attack threatening the organization’s existence
Description: In April 2024, the China-linked APT group Velvet Ant exploited zero-day vulnerability CVE-2024-20399 in Cisco switches to deploy custom malware, gaining control over the network devices. Attackers with valid administrator credentials executed commands as root, bypassing security measures and installing the 'VELVETSHELL' malware for persistent access and espionage. The malware granted capabilities for command execution, file management, and creating traffic tunnels, compromising the integrity of Cisco's network infrastructures and potentially leading to data exfiltration.
Splunk
Vulnerability
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Splunk has suffered a security incident due to two separate high-severity vulnerabilities. The first vulnerability enables RCE, allowing low-privileged users to execute arbitrary code through malicious file uploads, affecting Splunk Enterprise and Splunk Cloud Platform before certain versions. The second vulnerability affects the Splunk Secure Gateway app, where users can search with higher-privileged permissions, leading to potential unauthorized disclosure of sensitive information. Both issues have been patched, with suggested updates provided to Splunk users to remediate the risk. The security flaws highlight the critical importance of maintaining updated systems and monitoring access control within corporate environments to prevent data breaches and maintain operational integrity.
Cisco Company Scoring based on AI Models
Cyber Incidents Likelihood 3 - 6 - 9 months
A.I Risk Score Likelihood 3 - 6 - 9 months
Underwriter Stats for Cisco
Incidents vs Software Development Industry Average (This Year)
Cisco has 934.48% more incidents than the average of same-industry companies with at least one recorded incident.
Incidents vs All-Companies Average (This Year)
Cisco has 669.23% more incidents than the average of all companies with at least one recorded incident.
Incident Types Cisco vs Software Development Industry Avg (This Year)
Cisco reported 6 incidents this year: 2 cyber attacks, 1 ransomware, 3 vulnerabilities, 0 data breaches, compared to industry peers with at least 1 incident.
Incident History — Cisco (X = Date, Y = Severity)
Cisco cyber incidents detection timeline including parent company and subsidiaries
Cisco Company Subsidiaries
Cisco is the worldwide technology leader that is revolutionizing the way organizations connect and protect in the AI era. For more than 40 years, Cisco has securely connected the world. With its industry leading AI-powered solutions and services, Cisco enables its customers, partners and communities to unlock innovation, enhance productivity and strengthen digital resilience. With purpose at its core, Cisco remains committed to creating a more connected and inclusive future for all.
Loading...
Cisco Similar Companies
KPIT
About KPIT KPIT is reimagining the future of mobility, forging ahead with group companies and partners to shape a world that is cleaner, smarter, and safer. With over 25 years of specialized expertise in Mobility, KPIT is accelerating the transformation towards Software and AI-Defined Vehicles thr
We're a global online visual communications platform on a mission to empower the world to design. Featuring a simple drag-and-drop user interface and a vast range of templates ranging from presentations, documents, websites, social media graphics, posters, apparel to videos, plus a huge library of f
Microsoft
Every company has a mission. What's ours? To empower every person and every organization to achieve more. We believe technology can and should be a force for good and that meaningful innovation contributes to a brighter world in the future and today. Our culture doesn’t just encourage curiosity; it
Shopify is a leading global commerce company, providing trusted tools to start, grow, market, and manage a retail business of any size. Shopify makes commerce better for everyone with a platform and services that are engineered for reliability, while delivering a better shopping experience for consu
JD.COM
JD.com, also known as JINGDONG, is a leading e-commerce company transferring to be a technology and service enterprise with supply chain at its core. JD.com’s business has expanded across retail, technology, logistics, health, property development, industrials, and international business. Ranking 44
Intuit
Intuit is a global technology platform that helps our customers and communities overcome their most important financial challenges. Serving millions of customers worldwide with TurboTax, QuickBooks, Credit Karma and Mailchimp, we believe that everyone should have the opportunity to prosper and we wo
Nielsen
Nielsen shapes the world’s media and content as a global leader in audience insights, data and analytics. Through our understanding of people and their behaviors across all channels and platforms, we empower our clients with independent and actionable intelligence so they can connect and engage with
Tencent
Tencent is a world-leading internet and technology company that develops innovative products and services to improve the quality of life of people around the world. Founded in 1998 with its headquarters in Shenzhen, China, Tencent's guiding principle is to use technology for good. Our communication
GlobalLogic
GlobalLogic, a Hitachi Group company, is a trusted partner in design, data, and digital engineering for the world’s largest and most innovative companies. Since our inception in 2000, we have been at the forefront of the digital revolution, helping to create some of the most widely used digital prod
.png)
Cisco CyberSecurity News
December 03, 2025 08:12 PM
C Spire’s Bytes & Bites Annual Event Addresses AI and Cybersecurity
By Robert McFarland, Jr. The rise of artificial intelligence has become one of the defining issues of the modern era. And it's a topic that...
December 03, 2025 06:08 AM
Cisco XDR Agentic AI With Cisco’s Foundational AI Model
Generative AI has rapidly evolved across every industry — and cybersecurity is no exception. As organizations continue to explore AI-driven...
November 21, 2025 08:00 AM
PANW vs. CSCO: Which Cybersecurity Stock Should You Buy Right Now?
Palo Alto Networks (PANW) and Cisco Systems (CSCO) are well-known players in the cybersecurity domain. While PANW focuses broadly on...
November 20, 2025 08:00 AM
Splunk's Impact in Cybersecurity Gains Repeated Analyst Recognition
PRNewswire/ -- Cisco today announced Splunk's continued position as a leader in the rapidly evolving security information and event...
November 17, 2025 08:00 AM
Cybersecurity News: Windows 10 update failure, autonomous AI cyberattack, Feds fumble Cisco patches
Microsoft warns of potential Windows 10 update failure. The company has confirmed it is investigating an issue in which a bug causing the...
November 16, 2025 08:00 AM
New cybersecurity program to train Mississippians in Vicksburg
Rust College, MCITy, and Cisco Systems have launched a free cybersecurity training program in Vicksburg, offering stipends and...
November 14, 2025 08:00 AM
Urgent Patching Required to Fix Actively Exploited Cisco Flaws
Threat actors are actively exploiting multiple Cisco vulnerabilities for which patches were previously issued in August; however,...
November 14, 2025 08:00 AM
Cybersecurity Lessons For Leaders: Designing Resilience at Scale
Sausalito, Calif. – Nov. 14, 2025. – Read the full story in Forbes. “As an AI entrepreneur and cybersecurity leader, I've watched compliance...
November 13, 2025 08:00 AM
CISA urges immediate patching of Cisco ASA and Firepower devices due to active zero-day exploits
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has identified ongoing cyber threats targeting Cisco Adaptive Security...
Frequently Asked Questions
Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
Cisco CyberSecurity History Information
Official Website of Cisco
The official website of Cisco is http://www.cisco.com.
Cisco’s AI-Generated Cybersecurity Score
According to Rankiteo, Cisco’s AI-generated cybersecurity score is 636, reflecting their Poor security posture.
How many security badges does Cisco’ have ?
According to Rankiteo, Cisco currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
Does Cisco have SOC 2 Type 1 certification ?
According to Rankiteo, Cisco is not certified under SOC 2 Type 1.
Does Cisco have SOC 2 Type 2 certification ?
According to Rankiteo, Cisco does not hold a SOC 2 Type 2 certification.
Does Cisco comply with GDPR ?
According to Rankiteo, Cisco is not listed as GDPR compliant.
Does Cisco have PCI DSS certification ?
According to Rankiteo, Cisco does not currently maintain PCI DSS compliance.
Does Cisco comply with HIPAA ?
According to Rankiteo, Cisco is not compliant with HIPAA regulations.
Does Cisco have ISO 27001 certification ?
According to Rankiteo,Cisco is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
Industry Classification of Cisco
Cisco operates primarily in the Software Development industry.
Number of Employees at Cisco
Cisco employs approximately 95,475 people worldwide.
Subsidiaries Owned by Cisco
Cisco presently has no subsidiaries across any sectors.
Cisco’s LinkedIn Followers
Cisco’s official LinkedIn profile has approximately 7,252,763 followers.
NAICS Classification of Cisco
Cisco is classified under the NAICS code 5112, which corresponds to Software Publishers.
Cisco’s Presence on Crunchbase
No, Cisco does not have a profile on Crunchbase.
Cisco’s Presence on LinkedIn
Yes, Cisco maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/cisco.
Cybersecurity Incidents Involving Cisco
As of December 11, 2025, Rankiteo reports that Cisco has experienced 17 cybersecurity incidents.
Number of Peer and Competitor Companies
Cisco has an estimated 27,532 peer or competitor companies worldwide.
What types of cybersecurity incidents have occurred at Cisco ?
Incident Types: The types of cybersecurity incidents that have occurred include Data Leak, Vulnerability, Breach, Ransomware and Cyber Attack.
What was the total financial impact of these incidents on Cisco ?
Total Financial Loss: The total financial loss from these incidents is estimated to be $13.07 million.
How does Cisco detect and respond to cybersecurity incidents ?
Detection and Response: The company detects and responds to cybersecurity incidents through an containment measures with took action to contain and eradicate the bad actors, and remediation measures with patches provided to users, remediation measures with suggested updates to remediate risk, and containment measures with apply security updates, and remediation measures with update to 3.3 patch 7 and 3.4 patch 2, and and containment measures with disable radius authentication (switch to ldap/saml/local accounts), and remediation measures with apply free software updates provided by cisco, and communication strategy with public advisory via cisco’s august 2025 semiannual security advisory bundled publication, communication strategy with urgent recommendation for immediate patching, and and third party assistance with u.k. national cyber security centre (ncsc), third party assistance with canadian centre for cyber security, and containment measures with cisco patches for cve-2025-20362, cve-2025-20333, cve-2025-20363, containment measures with urgent advisories for updates, containment measures with disabling vpn web services on vulnerable devices, and remediation measures with firmware analysis to detect rayinitiator/line viper, remediation measures with replacement of end-of-support (eos) devices, remediation measures with implementation of secure boot/trust anchor on newer models, and communication strategy with public advisories by ncsc (2025-09-25), communication strategy with cisco security bulletins, communication strategy with canadian centre for cyber security alerts, and enhanced monitoring with recommended for asa/ftd devices, and and third party assistance with five eyes intelligence alliance, third party assistance with cisco internal teams, and containment measures with urgent patching of cisco asa vulnerabilities, containment measures with emergency directives (e.g., u.s. cisa's midnight deadline for federal agencies), and communication strategy with public warnings by cse (canada), cisa (u.s.), ncsc (uk), communication strategy with media statements (e.g., cbc news), communication strategy with collaboration with five eyes alliance, and enhanced monitoring with recommended (implied by urgency of patching and detection evasion concerns), and and third party assistance with cisco cybersecurity experts, and containment measures with cisa directive to identify affected devices, containment measures with data collection and threat assessment using cisa tools, and remediation measures with patching vulnerabilities (cve-2024-20353, cve-2024-20359), remediation measures with addressing cyber vulnerabilities in cisco devices, and communication strategy with public disclosure via bloomberg, communication strategy with cisa advisories, and enhanced monitoring with use of cisa cybersecurity tools for threat assessment, and incident response plan activated with cisco security advisory (2024-09-25), incident response plan activated with cisa emergency directive (24-hour patching mandate), incident response plan activated with ncsc (uk) threat report, and third party assistance with the shadowserver foundation (threat monitoring), third party assistance with greynoise (early warning scans), and containment measures with restrict vpn web interface exposure, containment measures with disconnect end-of-support (eos) asa devices, containment measures with increase logging/monitoring for suspicious vpn logins, and remediation measures with apply cisco patches for cve-2025-20333 and cve-2025-20362, remediation measures with follow cisco hardening guidelines, and communication strategy with cisco security advisories [1, 2], communication strategy with cisa emergency directive, communication strategy with ncsc threat report, and enhanced monitoring with monitor for crafted http requests, enhanced monitoring with track suspicious vpn logins, and third party assistance with fbi investigation, third party assistance with symantec (threat intelligence), third party assistance with kaspersky (decryption tool), and and remediation measures with kaspersky released free decrypter (2022), and and third party assistance with fbi, third party assistance with international law enforcement (italy), and .
Incident Details
Can you provide details on each incident ?
Title: Cisco Small Business RV Series Router Vulnerabilities
Description: Cisco has released security patches for multiple vulnerabilities in its Small Business RV Series router platform. This vulnerability could allow any remote attacker to gain complete control over the device without authentication. The attacker could execute arbitrary code, elevate privileges, run commands, bypass authentication protections, and retrieve and execute unsigned software if exploits the flaw.
Type: Vulnerability Exploitation
Attack Vector: RemoteUnauthenticated
Vulnerability Exploited: Multiple vulnerabilities in Cisco Small Business RV Series routers
Title: Cisco Hacked by Yanluowang Ransomware Gang
Description: Cisco experienced a ransomware attack by the Yanluowang gang, resulting in the alleged theft of 2.8GB of data.
Type: Ransomware
Threat Actor: Yanluowang ransomware gang
Motivation: Data theft and ransom
Title: Cisco Data Leak by Yanluowang Ransomware Gang
Description: Cisco was targeted in a data leak by the Yanluowang ransomware gang in September 2022. The gang leaked data stolen from the company network during a cyberattack in May. The stolen data included non-sensitive files from the employee’s Box folder and thousands of files amounting to 55GB, including classified documents, technical schematics, and source code.
Date Publicly Disclosed: 2022-09
Type: Data Leak
Threat Actor: Yanluowang Ransomware Gang
Title: Unauthorized Access to Cisco Cloud Infrastructure
Description: A former Cisco employee accessed the company's cloud infrastructure in 2018, five months after resigning, to deploy code that led to the shutdown of more than 16,000 WebEx Teams accounts and the deletion of 456 virtual machines.
Date Detected: 2018-09-24
Type: Unauthorized Access
Attack Vector: Unauthorized access to cloud infrastructure
Threat Actor: Sudhish Kasaba Ramesh
Motivation: Malicious intent
Title: Cisco Professional Careers Portal Data Leak
Description: Cisco has addressed a security flaw that allowed personal data to leak from the company's Professional Careers portal. The data leak occurred due to an erroneous security configuration on a third-party site following system repair.
Type: Data Leak
Attack Vector: Erroneous Security Configuration
Vulnerability Exploited: Security Misconfiguration
Title: Velvet Ant APT Group Exploits Cisco Switches
Description: In April 2024, the China-linked APT group Velvet Ant exploited zero-day vulnerability CVE-2024-20399 in Cisco switches to deploy custom malware, gaining control over the network devices. Attackers with valid administrator credentials executed commands as root, bypassing security measures and installing the 'VELVETSHELL' malware for persistent access and espionage. The malware granted capabilities for command execution, file management, and creating traffic tunnels, compromising the integrity of Cisco's network infrastructures and potentially leading to data exfiltration.
Date Detected: April 2024
Type: Advanced Persistent Threat (APT)
Attack Vector: Zero-day vulnerability exploitation
Vulnerability Exploited: CVE-2024-20399
Threat Actor: Velvet Ant
Motivation: Espionage
Title: Splunk Security Incident
Description: Splunk has suffered a security incident due to two separate high-severity vulnerabilities. The first vulnerability enables RCE, allowing low-privileged users to execute arbitrary code through malicious file uploads, affecting Splunk Enterprise and Splunk Cloud Platform before certain versions. The second vulnerability affects the Splunk Secure Gateway app, where users can search with higher-privileged permissions, leading to potential unauthorized disclosure of sensitive information. Both issues have been patched, with suggested updates provided to Splunk users to remediate the risk. The security flaws highlight the critical importance of maintaining updated systems and monitoring access control within corporate environments to prevent data breaches and maintain operational integrity.
Type: Security Vulnerabilities
Attack Vector: Malicious File UploadsPrivilege Escalation
Vulnerability Exploited: Remote Code Execution (RCE)Unauthorized Disclosure of Sensitive Information
Title: CVE-2018-0171 Exploitation in Cisco Networking Equipment
Description: A severe vulnerability in Cisco's networking equipment, identified as CVE-2018-0171, has been exploited by attackers, notably by the APT group Salt Typhoon. Despite a patch released in 2018, over 1,200 devices remain unpatched, providing an attack surface for unauthorized remote code execution and configuration theft. The attack chiefly involves using the Smart Install feature to extract sensitive data from networking devices, exacerbating the risk of further infiltrations and potentially catastrophic network breaches. This enduring security oversight, which notably affected telecommunications providers, exemplifies the danger legacy systems pose to the current technology infrastructure.
Type: Vulnerability Exploitation
Attack Vector: Remote Code Execution, Configuration Theft
Vulnerability Exploited: CVE-2018-0171
Threat Actor: Salt Typhoon
Motivation: Data Theft, Unauthorized Access
Title: Cisco Systems Data Breach
Description: A data breach occurred at Cisco Systems, Inc. due to a security setting error on the Cisco Professional Careers mobile website, potentially exposing job application-related personal information.
Date Detected: 2016-08-18
Date Publicly Disclosed: 2016-10-25
Type: Data Breach
Attack Vector: Security Setting Error
Vulnerability Exploited: Security Setting Error
Title: Critical Vulnerabilities in Cisco Identity Services Engine (ISE)
Description: Security researcher Bobby Gould has published a blog post demonstrating a complete exploit chain for CVE-2025-20281, an unauthenticated remote code execution vulnerability in Cisco Identity Services Engine (ISE). The critical vulnerability was first disclosed on June 25, 2025, with Cisco warning that it impacts ISE and ISE-PIC versions 3.3 and 3.4, allowing unauthenticated, remote attackers to upload arbitrary files to the target system and execute them with root privileges. The issue stems from unsafe deserialization and command injection in the enableStrongSwanTunnel() method. Three weeks later, the vendor added one more flaw to the same bulletin, CVE-2025-20337, which relates to the same flaw but is now broken down into two parts, CVE-2025-20281 (command injection) and CVE-2025-20337 (deserialization). Although hotfixes were previously made available, Cisco urged users to update to 3.3 Patch 7 and 3.4 Patch 2 to address both vulnerabilities. On July 22, 2025, Cisco marked both CVE-2025-20281 and CVE-2025-20337 as actively exploited in attacks, urging admins to apply the security updates as soon as possible.
Date Detected: 2025-06-25
Date Publicly Disclosed: 2025-06-25
Date Resolved: 2025-07-22
Type: Remote Code Execution
Attack Vector: Unauthenticated remote attack
Vulnerability Exploited: CVE-2025-20281CVE-2025-20337
Title: Critical Remote Code Execution Vulnerability in Cisco Secure Firewall Management Center (FMC) Software (CVE-2025-20265)
Description: Cisco has disclosed a critical security vulnerability (CVE-2025-20265, CVSS 10.0) in its Secure Firewall Management Center (FMC) Software, allowing unauthenticated attackers to execute arbitrary shell commands with high-level privileges remotely. The flaw resides in the RADIUS subsystem during the authentication phase, where improper input validation enables command injection via specially crafted credentials. No authentication is required, and exploitation is possible over the network. Affected versions include Cisco Secure FMC Software 7.0.7 and 7.7.0 when RADIUS authentication is enabled. No workarounds exist; patching or disabling RADIUS authentication (switching to LDAP/SAML/local accounts) are the only mitigations. Cisco has released free updates and urges immediate action. No public exploitation has been reported.
Date Publicly Disclosed: August 2025
Type: Vulnerability Disclosure
Attack Vector: NetworkRADIUS Authentication ExploitationUnauthenticated
Vulnerability Exploited: Cve Id: CVE-2025-20265, Cvss Score: 10.0, Component: RADIUS Subsystem (Authentication Phase), Root Cause: Insufficient Input Validation, 7.0.77.7.0RADIUS authentication enabled for web/SSH management
Title: Exploitation of Cisco Firewall Zero-Day Vulnerabilities by ArcaneDoor (UAT4356/Storm-1849) to Deploy RayInitiator and LINE VIPER Malware
Description: The U.K. National Cyber Security Centre (NCSC) revealed that threat actors (suspected China-linked hacking group UAT4356/Storm-1849, aka ArcaneDoor) exploited zero-day vulnerabilities in Cisco ASA 5500-X Series firewalls to deploy previously undocumented malware families (RayInitiator and LINE VIPER). The campaign targeted government agencies, leveraging memory corruption bugs (CVE-2025-20362, CVE-2025-20333) to bypass authentication, execute commands, and exfiltrate data. The attackers used advanced evasion techniques, including disabling logging, intercepting CLI commands, and crashing devices to hinder analysis. Persistence was achieved via ROMMON modifications on devices lacking Secure Boot/Trust Anchor. A third critical flaw (CVE-2025-20363) was patched but not exploited in the wild.
Date Detected: 2025-05
Date Publicly Disclosed: 2025-09-25
Type: Zero-day exploitation
Attack Vector: Exploitation of CVE-2025-20362 (CVSS 6.5)Exploitation of CVE-2025-20333 (CVSS 9.9)Multi-stage bootkit (RayInitiator)User-mode shellcode loader (LINE VIPER)ROMMON modification for persistenceWebVPN/HTTPS and ICMP/TCP C2 communication
Vulnerability Exploited: CVE-2025-20362 (Memory corruption in Cisco ASA Software)CVE-2025-20333 (Authentication bypass in Cisco ASA Software)Lack of Secure Boot/Trust Anchor in ASA 5500-X SeriesEnd-of-support (EoS) devices (ASA 5500-X Series)
Threat Actor: ArcaneDoorUAT4356Storm-1849Suspected China-linked state-sponsored group
Motivation: EspionageData exfiltrationPersistence in government networks
Title: Advanced Espionage Campaign Targeting Cisco ASA Devices (ArcaneDoor)
Description: Government cyber agencies worldwide are responding to a sophisticated espionage campaign targeting Cisco's adaptive security appliances (ASA), widely used for VPNs by remote workers. The threat actor, linked to the ArcaneDoor campaign, exploited vulnerabilities to implant malware, execute commands, and potentially exfiltrate data. Critical infrastructure sectors, including governments, academia, and research facilities, are urged to patch vulnerabilities immediately. The attack is described as state-sponsored and highly evasive, prompting emergency directives from the U.S. CISA and warnings from Canada's CSE and the UK's NCSC.
Date Detected: 2024-05
Date Publicly Disclosed: 2024-06-20
Type: Espionage
Attack Vector: Vulnerability Exploitation (Cisco ASA)Malware ImplantationCommand ExecutionPotential Data Exfiltration
Vulnerability Exploited: Unspecified Cisco ASA Vulnerabilities (ArcaneDoor Campaign)
Threat Actor: State-sponsored actor (high confidence; linked to ArcaneDoor campaign)
Motivation: Espionage
Title: Hackers hit the United States: Critical federal infrastructure compromised via Cisco networking equipment breach
Description: Hackers breached Cisco networking equipment belonging to several US government agencies on September 26, 2025. The attack, attributed to the ArcaneDoor hacker group, targeted critical U.S. federal cyber infrastructure, including Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. Zero-day vulnerabilities (CVE-2024-20353 and CVE-2024-20359) were exploited, enabling remote denial-of-service (DoS) attacks and privilege escalation from administrator to root access. The breach follows prior incidents in 2024 and a separate August 2025 hack of U.S. federal courts by Russian actors, where classified documents were stolen.
Date Detected: 2025-09-26
Date Publicly Disclosed: 2025-09-28
Type: Cyberattack
Attack Vector: Exploitation of Zero-Day Vulnerabilities (CVE-2024-20353, CVE-2024-20359)Remote Access
Vulnerability Exploited: CVE-2024-20353 (Infinite Loop DoS)CVE-2024-20359 (Privilege Escalation: Admin → Root)
Threat Actor: ArcaneDoor Hacker GroupRussian Hackers (for federal courts breach)
Motivation: EspionageCyber WarfareFinancial Gain (potential sale of exploit methods)
Title: Active Exploitation of Cisco ASA and FTD Vulnerabilities (CVE-2025-20333, CVE-2025-20362)
Description: Roughly 50,000 Cisco Adaptive Security Appliance (ASA) and Firewall Threat Defense (FTD) appliances exposed on the public web are vulnerable to two actively exploited vulnerabilities (CVE-2025-20333 and CVE-2025-20362). These flaws enable arbitrary code execution and unauthorized access to restricted VPN endpoints. Exploitation began before patches were available, with no workarounds existing. Over 48,800 internet-exposed instances remain unpatched as of September 29, 2024. Threat actors have deployed malware such as 'Line Viper' (shellcode loader) and 'RayInitiator' (GRUB bootkit). CISA issued an emergency directive mandating federal agencies to patch or disconnect affected devices within 24 hours.
Date Detected: 2024-08-01
Date Publicly Disclosed: 2024-09-25
Type: Vulnerability Exploitation
Attack Vector: Remote Code Execution (RCE)Unauthenticated Access to VPN EndpointsCrafted HTTP Requests
Vulnerability Exploited: CVE-2025-20333CVE-2025-20362
Motivation: Opportunistic ExploitationPotential Data TheftMalware Distribution
Title: Yanluowang Ransomware Attacks Facilitated by Initial Access Broker Aleksey Volkov
Description: A Russian national, Aleksey Olegovich Volkov (25), acted as an initial access broker for the Yanluowang ransomware gang, infiltrating networks of at least eight U.S.-based organizations (including banks, telecoms, and engineering firms) between July 2021 and November 2022. Volkov sold network access to the gang in exchange for a cut of ransom payments (totaling over $256,000 from two confirmed payouts of ~$1.5M). He also conducted DDoS attacks and threatening tactics to coerce victims. Volkov was arrested in Rome in 2023, extradited to the U.S., and agreed to a plea deal in 2025, including $9M in restitution. The Yanluowang group disbanded in late 2022 after its leak site was hacked, revealing its members were likely Russian (despite masquerading as Chinese).
Date Publicly Disclosed: 2025-10-29
Type: Ransomware
Attack Vector: Exploited Vulnerabilities (unspecified)Phishing/Social Engineering (likely)DDoS AttacksThreatening Calls to Executives
Threat Actor: Name: Aleksey Olegovich Volkov (aka 'chubaka.kor')Affiliation: ['Yanluowang Ransomware Gang', 'LockBit Ransomware Gang (alleged communication)']Nationality: RussianRole: Initial Access BrokerAliases: ['chubaka.kor', 'Alekseq Olegovi3 Volkov']Birthdate: 2000-03-20Cryptocurrency Wallets: ['Linked to Russian passport-verified account']Email: [email protected] Id: [email protected]
Motivation: Financial Gain (ransomware proceeds, access sales)
Title: Yanluowang Ransomware Attacks Facilitated by Initial Access Broker Aleksey Olegovich Volkov
Description: A Russian national, Aleksey Olegovich Volkov (aliases: 'chubaka.kor', 'nets'), acted as an initial access broker (IAB) for Yanluowang ransomware attacks targeting at least eight U.S. companies between July 2021 and November 2022. Volkov breached corporate networks, sold access to the ransomware group, and received a percentage of ransom payments totaling $1.5 million from two victims. He was linked to attacks on companies across multiple U.S. states, including a Philadelphia-based company, an engineering firm, a California company, a Michigan bank, an Illinois business, a Georgia company, an Ohio telecommunications provider, and a business in the Eastern District of Pennsylvania. Volkov was arrested in Italy in January 2024, extradited to the U.S., and faces up to 53 years in prison along with $9.1 million in restitution.
Date Publicly Disclosed: 2024-10-29
Type: ransomware
Attack Vector: credential theftnetwork intrusionsocial engineering (potential)exploitation of vulnerabilities (unspecified)
Threat Actor: Name: Aleksey Olegovich VolkovAliases: ['chubaka.kor', 'nets', '[email protected]', '[email protected]']Affiliation: ['Yanluowang ransomware group', 'potential link to LockBit ransomware gang']Nationality: RussianStatus: arrested (January 2024), extradited to U.S., pleaded guilty (October 29, 2024)
Motivation: financial gain
What are the most common types of attacks the company has faced ?
Common Attack Types: The most common types of attacks the company has faced is Vulnerability.
How does the company identify the attack vectors used in incidents ?
Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Amazon Web Services, Cisco switches, Smart Install Feature, CVE-2025-20362 and CVE-2025-20333 in Cisco ASA VPN web services, Vulnerabilities in Cisco ASA devices (legacy systems targeted), Cisco ASA/FTD vulnerabilities (CVE-2024-20353, CVE-2024-20359), Exposed VPN Web InterfacesCrafted HTTP Requests Targeting CVE-2025-20333/CVE-2025-20362, Exploited Vulnerabilities (unspecified)Potential Phishing and corporate network breaches (method unspecified).
Impact of the Incidents
What was the impact of each incident ?
Incident : Vulnerability Exploitation CIS13829322
Systems Affected: Cisco Small Business RV Series routers
Incident : Ransomware CIS0217922
Data Compromised: Cisco products or services, Sensitive customer data, Sensitive employee information, Intellectual property, Supply chain operations
Incident : Data Leak CIS193291022
Data Compromised: Non-sensitive files, Classified documents, Technical schematics, Source code
Incident : Unauthorized Access CIS205918123
Financial Loss: $2,400,000
Systems Affected: 16,000 WebEx Teams accounts456 virtual machines
Operational Impact: Significant
Incident : Data Leak CIS1221121123
Data Compromised: Name, Password, Email address, Phone number, Security question answers, Professional profile, Educational background, Cover letter, Resume content
Systems Affected: Professional Careers portal
Incident : Advanced Persistent Threat (APT) CIS000082424
Systems Affected: Cisco switches
Incident : Security Vulnerabilities SPL355032725
Systems Affected: Splunk EnterpriseSplunk Cloud PlatformSplunk Secure Gateway app
Incident : Vulnerability Exploitation CIS929041225
Data Compromised: Sensitive Data
Systems Affected: Networking Devices
Incident : Data Breach CIS747072825
Data Compromised: Names, Addresses, Emails, Phone numbers, Other sensitive data
Systems Affected: Cisco Professional Careers mobile website
Incident : Remote Code Execution CIS905072925
Systems Affected: Cisco ISE and ISE-PIC versions 3.3 and 3.4
Incident : Vulnerability Disclosure CIS751081525
Systems Affected: Cisco Secure Firewall Management Center (FMC) Software (versions 7.0.7, 7.7.0 with RADIUS enabled)
Operational Impact: Potential disruption if RADIUS authentication is disabled (requires reconfiguration to LDAP/SAML/local accounts)Emergency patching may require maintenance windows
Brand Reputation Impact: High (critical vulnerability in enterprise firewall infrastructure)
Incident : Zero-day exploitation CIS5262052092625
Data Compromised: Potential exfiltration from government agencies, Vpn credentials (via aaa bypass), Cli commands (harvested), Packet captures
Systems Affected: Cisco ASA 5500-X Series (5512-X, 5515-X, 5525-X, 5545-X, 5555-X, 5585-X)Devices running Cisco ASA Software 9.12 or 9.14 with VPN web services enabled
Downtime: ['Intentional device crashes to evade analysis', 'Delayed reboots triggered by LINE VIPER']
Operational Impact: Compromised firewall integrityBypassed authentication (AAA)Suppressed syslog messagesModified CLI commands (e.g., copy, verify)
Brand Reputation Impact: Potential loss of trust in Cisco ASA security productsGovernment agencies targeted
Identity Theft Risk: ['Potential risk if VPN credentials were exfiltrated']
Incident : Espionage CIS5802058092725
Systems Affected: Cisco Adaptive Security Appliances (ASA)VPN-enabled systems used by remote workers
Operational Impact: High (potential data exfiltration, command execution, and malware persistence in critical infrastructure sectors)
Brand Reputation Impact: Moderate to High (urgent global warnings issued by cyber agencies)
Incident : Cyberattack CIS2032020092825
Data Compromised: Classified documents (espionage, fraud, money laundering, foreign agent activities)
Systems Affected: Cisco Adaptive Security Appliance (ASA)Firepower Threat Defense (FTD) softwareHundreds of Cisco firewall devicesU.S. federal courts computer systems
Operational Impact: Disruption of federal cyber infrastructurePotential loss of sensitive government data
Brand Reputation Impact: Erosion of public trust in U.S. federal cybersecurityReputational damage to Cisco
Incident : Vulnerability Exploitation CIS0692106093025
Systems Affected: 50,000 (48,800 confirmed unpatched as of 2024-09-29)
Operational Impact: Potential Unauthorized VPN AccessMalware Infection (Line Viper, RayInitiator)Risk of Lateral Movement
Brand Reputation Impact: Potential Erosion of Trust in Cisco Security ProductsRegulatory Scrutiny
Legal Liabilities: Non-Compliance with CISA Emergency Directive for Federal AgenciesPotential Violations of Data Protection Laws
Incident : Ransomware CIS0702107111125
Financial Loss: $1.5M+ (confirmed ransom payments) + $9M (restitution agreed in plea deal)
Operational Impact: System LockoutsDDoS DisruptionsExecutive Threats
Brand Reputation Impact: High (targeted high-profile U.S. firms)Associated with extortion tactics
Legal Liabilities: Plea deal for hacking, extortion, and theft chargesDecades-long prison sentence pending
Incident : ransomware CIS2802228111125
Financial Loss: $9,167,198.19 (restitution amount)
Legal Liabilities: $9,167,198.19 (restitution) + potential fines
Identity Theft Risk: True
What is the average financial loss per incident ?
Average Financial Loss: The average financial loss per incident is $768.66 thousand.
What types of data are most commonly compromised in incidents ?
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Cisco Products Or Services, Sensitive Customer Data, Sensitive Employee Information, Intellectual Property, Supply Chain Operations, , Non-Sensitive Files, Classified Documents, Technical Schematics, Source Code, , Personal Details, Professional Profile, Educational Background, Cover Letter, Resume Content, , Sensitive Data, Personal Information, , Vpn Authentication Data, Cli Command History, Network Packet Captures, Potential Government Data, , Classified Government Documents, Espionage-Related Data, Fraud/Money Laundering Records, Foreign Agent Activities, , Corporate Network Credentials, Stolen Data (Unspecified), Non-Sensitive Files (Cisco Box Folder) and .
Which entities were affected by each incident ?
Incident : Vulnerability Exploitation CIS13829322
Entity Name: Cisco
Entity Type: Organization
Industry: Technology
Incident : Unauthorized Access CIS205918123
Entity Name: Cisco
Entity Type: Company
Industry: Technology
Incident : Advanced Persistent Threat (APT) CIS000082424
Entity Name: Cisco
Entity Type: Organization
Industry: Technology
Incident : Security Vulnerabilities SPL355032725
Entity Name: Splunk
Entity Type: Corporation
Industry: Software
Incident : Vulnerability Exploitation CIS929041225
Entity Name: Cisco
Entity Type: Technology Company
Industry: Networking Equipment
Incident : Data Breach CIS747072825
Entity Name: Cisco Systems, Inc.
Entity Type: Company
Industry: Technology
Location: California
Incident : Remote Code Execution CIS905072925
Entity Name: Cisco
Entity Type: Vendor
Industry: Technology
Incident : Vulnerability Disclosure CIS751081525
Entity Name: Cisco Systems, Inc.
Entity Type: Corporation
Industry: Networking Hardware, Cybersecurity
Location: San Jose, California, USA
Size: Large Enterprise
Incident : Zero-day exploitation CIS5262052092625
Entity Name: Multiple government agencies (unspecified)
Entity Type: Government
Industry: Public sector
Location: United KingdomCanada (advisory issued)
Incident : Zero-day exploitation CIS5262052092625
Entity Name: Cisco Systems
Entity Type: Corporation
Industry: Networking/IT Security
Location: Global
Size: Large enterprise
Customers Affected: Users of Cisco ASA 5500-X Series devices
Incident : Espionage CIS5802058092725
Entity Name: Cisco Systems, Inc.
Entity Type: Technology Company
Industry: Networking and Cybersecurity
Location: Global (headquartered in San Jose, California, USA)
Size: Large (Enterprise)
Customers Affected: Critical infrastructure sectors (municipal, provincial, territorial governments; academia; research facilities; organizations using Cisco ASA for VPNs)
Incident : Espionage CIS5802058092725
Entity Name: Critical Infrastructure Sectors (Canada, U.S., UK, and Five Eyes Allies)
Entity Type: Government, Academia, Research Facilities
Industry: Multiple (Public Sector, Education, Research)
Location: CanadaUnited StatesUnited KingdomFive Eyes Alliance Nations
Incident : Cyberattack CIS2032020092825
Entity Name: United States Federal Government
Entity Type: Government
Industry: Public Sector
Location: United States
Incident : Cyberattack CIS2032020092825
Entity Name: U.S. Cybersecurity and Information Technology Infrastructure Agency (CISA)
Entity Type: Government Agency
Industry: Cybersecurity
Location: United States
Incident : Cyberattack CIS2032020092825
Entity Name: U.S. Federal Courts
Entity Type: Judicial Branch
Industry: Legal
Location: United States
Incident : Cyberattack CIS2032020092825
Entity Name: Cisco Systems
Entity Type: Corporation
Industry: Networking & Cybersecurity
Location: United States (Global)
Customers Affected: U.S. government agencies (hundreds of firewall devices)
Incident : Vulnerability Exploitation CIS0692106093025
Entity Name: Cisco Systems, Inc.
Entity Type: Technology Vendor
Industry: Networking and Cybersecurity
Location: Global
Size: Large Enterprise
Customers Affected: 50,000+ (exposed ASA/FTD appliances)
Incident : Vulnerability Exploitation CIS0692106093025
Entity Name: Federal Civilian Executive Branch (FCEB) Agencies (U.S.)
Entity Type: Government
Industry: Public Sector
Location: United States
Incident : Vulnerability Exploitation CIS0692106093025
Entity Name: Organizations Using Cisco ASA/FTD (Global)
Entity Type: Private Sector, Public Sector, Critical Infrastructure
Industry: Multiple
Location: United States (19,200+ endpoints)United Kingdom (2,800)Japan (2,300)Germany (2,200)Russia (2,100)Canada (1,500)Denmark (1,200)
Incident : Ransomware CIS0702107111125
Entity Name: Unnamed Bank (Pennsylvania)
Entity Type: Financial Institution
Industry: Banking
Location: Pennsylvania, USA
Incident : Ransomware CIS0702107111125
Entity Name: Unnamed Telecommunications Company (California)
Entity Type: Private Company
Industry: Telecommunications
Location: California, USA
Incident : Ransomware CIS0702107111125
Entity Name: Unnamed Engineering Firm (Michigan)
Entity Type: Private Company
Industry: Engineering
Location: Michigan, USA
Incident : Ransomware CIS0702107111125
Entity Name: Unnamed Organization (Illinois)
Location: Illinois, USA
Incident : Ransomware CIS0702107111125
Entity Name: Unnamed Organization (Georgia)
Location: Georgia, USA
Incident : Ransomware CIS0702107111125
Entity Name: Cisco Systems
Entity Type: Public Company
Industry: Technology/Networking
Location: California, USA
Size: Large Enterprise
Incident : Ransomware CIS0702107111125
Entity Name: Walmart
Entity Type: Public Company
Industry: Retail
Location: Arkansas, USA
Size: Large Enterprise
Incident : ransomware CIS2802228111125
Entity Name: Philadelphia-based company
Location: Philadelphia, Pennsylvania, U.S.
Incident : ransomware CIS2802228111125
Entity Name: Engineering firm
Industry: engineering
Location: 19 U.S. offices (exact locations unspecified)
Incident : ransomware CIS2802228111125
Entity Name: Michigan bank
Entity Type: bank
Industry: financial services
Location: Michigan, U.S.
Incident : ransomware CIS2802228111125
Entity Name: Ohio telecommunications provider
Entity Type: telecommunications
Industry: telecommunications
Location: Ohio, U.S.
Incident : ransomware CIS2802228111125
Entity Name: Business in the Eastern District of Pennsylvania
Location: Eastern District of Pennsylvania, U.S.
Incident : ransomware CIS2802228111125
Entity Name: Cisco
Entity Type: technology corporation
Industry: IT/Networking
Location: global (HQ: San Jose, California, U.S.)
Size: large enterprise
Response to the Incidents
What measures were taken in response to each incident ?
Incident : Ransomware CIS0217922
Containment Measures: Took action to contain and eradicate the bad actors
Incident : Security Vulnerabilities SPL355032725
Remediation Measures: Patches provided to usersSuggested updates to remediate risk
Incident : Remote Code Execution CIS905072925
Containment Measures: Apply security updates
Remediation Measures: Update to 3.3 Patch 7 and 3.4 Patch 2
Incident : Vulnerability Disclosure CIS751081525
Incident Response Plan Activated: True
Containment Measures: Disable RADIUS authentication (switch to LDAP/SAML/local accounts)
Remediation Measures: Apply free software updates provided by Cisco
Communication Strategy: Public advisory via Cisco’s August 2025 Semiannual Security Advisory Bundled PublicationUrgent recommendation for immediate patching
Incident : Zero-day exploitation CIS5262052092625
Incident Response Plan Activated: True
Third Party Assistance: U.K. National Cyber Security Centre (Ncsc), Canadian Centre For Cyber Security.
Containment Measures: Cisco patches for CVE-2025-20362, CVE-2025-20333, CVE-2025-20363Urgent advisories for updatesDisabling VPN web services on vulnerable devices
Remediation Measures: Firmware analysis to detect RayInitiator/LINE VIPERReplacement of end-of-support (EoS) devicesImplementation of Secure Boot/Trust Anchor on newer models
Communication Strategy: Public advisories by NCSC (2025-09-25)Cisco security bulletinsCanadian Centre for Cyber Security alerts
Enhanced Monitoring: Recommended for ASA/FTD devices
Incident : Espionage CIS5802058092725
Incident Response Plan Activated: True
Third Party Assistance: Five Eyes Intelligence Alliance, Cisco Internal Teams.
Containment Measures: Urgent Patching of Cisco ASA VulnerabilitiesEmergency Directives (e.g., U.S. CISA's midnight deadline for federal agencies)
Communication Strategy: Public Warnings by CSE (Canada), CISA (U.S.), NCSC (UK)Media Statements (e.g., CBC News)Collaboration with Five Eyes Alliance
Enhanced Monitoring: Recommended (implied by urgency of patching and detection evasion concerns)
Incident : Cyberattack CIS2032020092825
Incident Response Plan Activated: True
Third Party Assistance: Cisco Cybersecurity Experts.
Containment Measures: CISA directive to identify affected devicesData collection and threat assessment using CISA tools
Remediation Measures: Patching vulnerabilities (CVE-2024-20353, CVE-2024-20359)Addressing cyber vulnerabilities in Cisco devices
Communication Strategy: Public disclosure via BloombergCISA advisories
Enhanced Monitoring: Use of CISA cybersecurity tools for threat assessment
Incident : Vulnerability Exploitation CIS0692106093025
Incident Response Plan Activated: ['Cisco Security Advisory (2024-09-25)', 'CISA Emergency Directive (24-hour patching mandate)', 'NCSC (UK) Threat Report']
Third Party Assistance: The Shadowserver Foundation (Threat Monitoring), Greynoise (Early Warning Scans).
Containment Measures: Restrict VPN Web Interface ExposureDisconnect End-of-Support (EoS) ASA DevicesIncrease Logging/Monitoring for Suspicious VPN Logins
Remediation Measures: Apply Cisco Patches for CVE-2025-20333 and CVE-2025-20362Follow Cisco Hardening Guidelines
Communication Strategy: Cisco Security Advisories [1, 2]CISA Emergency DirectiveNCSC Threat Report
Enhanced Monitoring: Monitor for Crafted HTTP RequestsTrack Suspicious VPN Logins
Incident : Ransomware CIS0702107111125
Third Party Assistance: Fbi Investigation, Symantec (Threat Intelligence), Kaspersky (Decryption Tool).
Remediation Measures: Kaspersky released free decrypter (2022)
Incident : ransomware CIS2802228111125
Incident Response Plan Activated: True
Third Party Assistance: Fbi, International Law Enforcement (Italy).
What is the company's incident response plan?
Incident Response Plan: The company's incident response plan is described as Cisco Security Advisory (2024-09-25), CISA Emergency Directive (24-hour patching mandate), NCSC (UK) Threat Report, , .
How does the company involve third-party assistance in incident response ?
Third-Party Assistance: The company involves third-party assistance in incident response through U.K. National Cyber Security Centre (NCSC), Canadian Centre for Cyber Security, , Five Eyes Intelligence Alliance, Cisco Internal Teams, , Cisco Cybersecurity Experts, , The Shadowserver Foundation (Threat Monitoring), Greynoise (Early Warning Scans), , FBI Investigation, Symantec (Threat Intelligence), Kaspersky (Decryption Tool), , FBI, international law enforcement (Italy), .
Data Breach Information
What type of data was compromised in each breach ?
Incident : Ransomware CIS0217922
Type of Data Compromised: Cisco products or services, Sensitive customer data, Sensitive employee information, Intellectual property, Supply chain operations
Sensitivity of Data: High
Data Exfiltration: 2.8GB
Incident : Data Leak CIS193291022
Type of Data Compromised: Non-sensitive files, Classified documents, Technical schematics, Source code
Sensitivity of Data: non-sensitivehigh
File Types Exposed: documentsschematicssource code
Incident : Data Leak CIS1221121123
Type of Data Compromised: Personal details, Professional profile, Educational background, Cover letter, Resume content
Personally Identifiable Information: nameemail addressphone numbersecurity question answers
Incident : Vulnerability Exploitation CIS929041225
Type of Data Compromised: Sensitive Data
Sensitivity of Data: High
Incident : Data Breach CIS747072825
Type of Data Compromised: Personal information
Sensitivity of Data: High
Personally Identifiable Information: namesaddressesemailsphone numbers
Incident : Zero-day exploitation CIS5262052092625
Type of Data Compromised: Vpn authentication data, Cli command history, Network packet captures, Potential government data
Sensitivity of Data: High (government agencies targeted)Potential classified information
Data Exfiltration: Likely (via LINE VIPER C2 channels)
Incident : Espionage CIS5802058092725
Data Exfiltration: Potential (malware designed for exfiltration)
Incident : Cyberattack CIS2032020092825
Type of Data Compromised: Classified government documents, Espionage-related data, Fraud/money laundering records, Foreign agent activities
Sensitivity of Data: High (Classified)
Incident : Ransomware CIS0702107111125
Data Exfiltration: Likely (based on ransomware MO)
Data Encryption: ['Yanluowang custom encryption (vulnerability found by Kaspersky)']
Incident : ransomware CIS2802228111125
Type of Data Compromised: Corporate network credentials, Stolen data (unspecified), Non-sensitive files (cisco box folder)
Sensitivity of Data: low (Cisco case: non-sensitive files)high (credentials, corporate data)
Data Encryption: True
What measures does the company take to prevent data exfiltration ?
Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Patches provided to users, Suggested updates to remediate risk, , Update to 3.3 Patch 7 and 3.4 Patch 2, Apply free software updates provided by Cisco, , Firmware analysis to detect RayInitiator/LINE VIPER, Replacement of end-of-support (EoS) devices, Implementation of Secure Boot/Trust Anchor on newer models, , Patching vulnerabilities (CVE-2024-20353, CVE-2024-20359), Addressing cyber vulnerabilities in Cisco devices, , Apply Cisco Patches for CVE-2025-20333 and CVE-2025-20362, Follow Cisco Hardening Guidelines, , Kaspersky released free decrypter (2022), .
How does the company handle incidents involving personally identifiable information (PII) ?
Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by took action to contain and eradicate the bad actors, , apply security updates, disable radius authentication (switch to ldap/saml/local accounts), , cisco patches for cve-2025-20362, cve-2025-20333, cve-2025-20363, urgent advisories for updates, disabling vpn web services on vulnerable devices, , urgent patching of cisco asa vulnerabilities, emergency directives (e.g., u.s. cisa's midnight deadline for federal agencies), , cisa directive to identify affected devices, data collection and threat assessment using cisa tools, , restrict vpn web interface exposure, disconnect end-of-support (eos) asa devices, increase logging/monitoring for suspicious vpn logins and .
Ransomware Information
Was ransomware involved in any of the incidents ?
Incident : Cyberattack CIS2032020092825
Data Exfiltration: True
Incident : Ransomware CIS0702107111125
Ransom Demanded: $1.5M+ (confirmed from two victims)
Ransom Paid: $1.5M+ (confirmed)
Ransomware Strain: Yanluowang
Data Encryption: True
Data Exfiltration: ['Double Extortion (likely)']
Incident : ransomware CIS2802228111125
Ransom Demanded: $300,000 to $15,000,000 (per victim)
Ransom Paid: $1,500,000 (total from two victims)
Ransomware Strain: Yanluowang
Data Encryption: True
Data Exfiltration: True
Regulatory Compliance
Were there any regulatory violations and fines imposed for each incident ?
Incident : Zero-day exploitation CIS5262052092625
Regulatory Notifications: U.K. NCSC advisory (2025-09-25)Canadian Centre for Cyber Security advisory
Incident : Espionage CIS5802058092725
Regulatory Notifications: Emergency Directives (e.g., U.S. CISA)Public Advisories (CSE, NCSC)
Incident : Cyberattack CIS2032020092825
Regulatory Notifications: CISA directives to federal agencies
Incident : Vulnerability Exploitation CIS0692106093025
Regulations Violated: CISA Emergency Directive (Non-Compliance Risk for Federal Agencies),
Regulatory Notifications: CISA Mandate for Federal AgenciesNCSC (UK) Advisory
Incident : Ransomware CIS0702107111125
Legal Actions: U.S. Federal Charges (hacking, theft, extortion), Plea Deal (2025-10-29), Extradition from Italy (2023),
Incident : ransomware CIS2802228111125
Legal Actions: arrest (Italy, January 2024), extradition to U.S., guilty plea (October 29, 2024), charges: unlawful transfer of means of identification, trafficking in access information, access device fraud, aggravated identity theft, conspiracy to commit computer fraud, conspiracy to commit money laundering,
How does the company ensure compliance with regulatory requirements ?
Ensuring Regulatory Compliance: The company ensures compliance with regulatory requirements through U.S. Federal Charges (hacking, theft, extortion), Plea Deal (2025-10-29), Extradition from Italy (2023), , arrest (Italy, January 2024), extradition to U.S., guilty plea (October 29, 2024), charges: unlawful transfer of means of identification, trafficking in access information, access device fraud, aggravated identity theft, conspiracy to commit computer fraud, conspiracy to commit money laundering, .
Lessons Learned and Recommendations
What lessons were learned from each incident ?
Incident : Security Vulnerabilities SPL355032725
Lessons Learned: The critical importance of maintaining updated systems and monitoring access control within corporate environments to prevent data breaches and maintain operational integrity.
Incident : Vulnerability Disclosure CIS751081525
Lessons Learned: Proactive internal security testing can uncover critical vulnerabilities before exploitation (discovered by Brandon Sakai of Cisco)., Vulnerabilities in authentication systems (e.g., RADIUS) can have severe impacts if input validation is insufficient., Lack of workarounds for critical flaws underscores the importance of patch management and alternative mitigation strategies (e.g., disabling vulnerable features).
Incident : Zero-day exploitation CIS5262052092625
Lessons Learned: End-of-support (EoS) devices pose significant risks even if functional, Advanced threat actors leverage multi-stage malware (bootkits + shellcode loaders) to evade detection, Persistence mechanisms (e.g., ROMMON modifications) can survive reboots/upgrades on legacy hardware, VPN web services are a high-value target for APT groups, Secure Boot/Trust Anchor technologies are critical for mitigating firmware-level attacks
Incident : Vulnerability Exploitation CIS0692106093025
Lessons Learned: Proactive Patching is Critical for Zero-Day Vulnerabilities, Exposed VPN Interfaces Are High-Risk Targets, Federal Directives Can Accelerate Response in Critical Infrastructure, Threat Intelligence Sharing (e.g., Shadowserver, Greynoise) Provides Early Warnings
Incident : Ransomware CIS0702107111125
Lessons Learned: Initial access brokers play a critical role in ransomware ecosystems, enabling attacks by selling pre-compromised access., Threat actors often masquerade as other nationalities (e.g., Yanluowang posed as Chinese but was Russian)., Cryptocurrency tracing and digital breadcrumbs (e.g., email, Apple ID) are vital for attribution., Collaboration between cybersecurity firms (Symantec, Kaspersky) and law enforcement (FBI) can disrupt ransomware operations., Leaked internal chats can expose operational details and debunk threat actor personas.
What recommendations were made to prevent future incidents ?
Incident : Remote Code Execution CIS905072925
Recommendations: Apply the patches as directed in the vendor's bulletin.
Incident : Vulnerability Disclosure CIS751081525
Recommendations: Immediately patch affected Cisco Secure FMC Software (versions 7.0.7, 7.7.0) to the latest release., Disable RADIUS authentication if patching is not immediately feasible, and switch to LDAP, SAML SSO, or local accounts., Prioritize this vulnerability as a 'priority-one' patching scenario due to its critical severity (CVSS 10.0) and potential for unauthenticated remote code execution., Conduct a review of all authentication mechanisms in enterprise firewall infrastructure to identify similar input validation risks., Monitor for unusual authentication attempts or command execution on FMC systems until patches are applied.Immediately patch affected Cisco Secure FMC Software (versions 7.0.7, 7.7.0) to the latest release., Disable RADIUS authentication if patching is not immediately feasible, and switch to LDAP, SAML SSO, or local accounts., Prioritize this vulnerability as a 'priority-one' patching scenario due to its critical severity (CVSS 10.0) and potential for unauthenticated remote code execution., Conduct a review of all authentication mechanisms in enterprise firewall infrastructure to identify similar input validation risks., Monitor for unusual authentication attempts or command execution on FMC systems until patches are applied.Immediately patch affected Cisco Secure FMC Software (versions 7.0.7, 7.7.0) to the latest release., Disable RADIUS authentication if patching is not immediately feasible, and switch to LDAP, SAML SSO, or local accounts., Prioritize this vulnerability as a 'priority-one' patching scenario due to its critical severity (CVSS 10.0) and potential for unauthenticated remote code execution., Conduct a review of all authentication mechanisms in enterprise firewall infrastructure to identify similar input validation risks., Monitor for unusual authentication attempts or command execution on FMC systems until patches are applied.Immediately patch affected Cisco Secure FMC Software (versions 7.0.7, 7.7.0) to the latest release., Disable RADIUS authentication if patching is not immediately feasible, and switch to LDAP, SAML SSO, or local accounts., Prioritize this vulnerability as a 'priority-one' patching scenario due to its critical severity (CVSS 10.0) and potential for unauthenticated remote code execution., Conduct a review of all authentication mechanisms in enterprise firewall infrastructure to identify similar input validation risks., Monitor for unusual authentication attempts or command execution on FMC systems until patches are applied.Immediately patch affected Cisco Secure FMC Software (versions 7.0.7, 7.7.0) to the latest release., Disable RADIUS authentication if patching is not immediately feasible, and switch to LDAP, SAML SSO, or local accounts., Prioritize this vulnerability as a 'priority-one' patching scenario due to its critical severity (CVSS 10.0) and potential for unauthenticated remote code execution., Conduct a review of all authentication mechanisms in enterprise firewall infrastructure to identify similar input validation risks., Monitor for unusual authentication attempts or command execution on FMC systems until patches are applied.
Incident : Zero-day exploitation CIS5262052092625
Recommendations: Immediately patch CVE-2025-20362, CVE-2025-20333, and CVE-2025-20363, Replace end-of-support Cisco ASA 5500-X Series devices, Enable Secure Boot and Trust Anchor on supported devices, Disable VPN web services if not essential, Monitor for unusual CLI command activity or syslog suppression, Deploy network segmentation to limit lateral movement, Conduct forensic analysis of ASA firmware for signs of RayInitiator/LINE VIPER, Implement behavioral detection for ICMP/TCP and WebVPN C2 trafficImmediately patch CVE-2025-20362, CVE-2025-20333, and CVE-2025-20363, Replace end-of-support Cisco ASA 5500-X Series devices, Enable Secure Boot and Trust Anchor on supported devices, Disable VPN web services if not essential, Monitor for unusual CLI command activity or syslog suppression, Deploy network segmentation to limit lateral movement, Conduct forensic analysis of ASA firmware for signs of RayInitiator/LINE VIPER, Implement behavioral detection for ICMP/TCP and WebVPN C2 trafficImmediately patch CVE-2025-20362, CVE-2025-20333, and CVE-2025-20363, Replace end-of-support Cisco ASA 5500-X Series devices, Enable Secure Boot and Trust Anchor on supported devices, Disable VPN web services if not essential, Monitor for unusual CLI command activity or syslog suppression, Deploy network segmentation to limit lateral movement, Conduct forensic analysis of ASA firmware for signs of RayInitiator/LINE VIPER, Implement behavioral detection for ICMP/TCP and WebVPN C2 trafficImmediately patch CVE-2025-20362, CVE-2025-20333, and CVE-2025-20363, Replace end-of-support Cisco ASA 5500-X Series devices, Enable Secure Boot and Trust Anchor on supported devices, Disable VPN web services if not essential, Monitor for unusual CLI command activity or syslog suppression, Deploy network segmentation to limit lateral movement, Conduct forensic analysis of ASA firmware for signs of RayInitiator/LINE VIPER, Implement behavioral detection for ICMP/TCP and WebVPN C2 trafficImmediately patch CVE-2025-20362, CVE-2025-20333, and CVE-2025-20363, Replace end-of-support Cisco ASA 5500-X Series devices, Enable Secure Boot and Trust Anchor on supported devices, Disable VPN web services if not essential, Monitor for unusual CLI command activity or syslog suppression, Deploy network segmentation to limit lateral movement, Conduct forensic analysis of ASA firmware for signs of RayInitiator/LINE VIPER, Implement behavioral detection for ICMP/TCP and WebVPN C2 trafficImmediately patch CVE-2025-20362, CVE-2025-20333, and CVE-2025-20363, Replace end-of-support Cisco ASA 5500-X Series devices, Enable Secure Boot and Trust Anchor on supported devices, Disable VPN web services if not essential, Monitor for unusual CLI command activity or syslog suppression, Deploy network segmentation to limit lateral movement, Conduct forensic analysis of ASA firmware for signs of RayInitiator/LINE VIPER, Implement behavioral detection for ICMP/TCP and WebVPN C2 trafficImmediately patch CVE-2025-20362, CVE-2025-20333, and CVE-2025-20363, Replace end-of-support Cisco ASA 5500-X Series devices, Enable Secure Boot and Trust Anchor on supported devices, Disable VPN web services if not essential, Monitor for unusual CLI command activity or syslog suppression, Deploy network segmentation to limit lateral movement, Conduct forensic analysis of ASA firmware for signs of RayInitiator/LINE VIPER, Implement behavioral detection for ICMP/TCP and WebVPN C2 trafficImmediately patch CVE-2025-20362, CVE-2025-20333, and CVE-2025-20363, Replace end-of-support Cisco ASA 5500-X Series devices, Enable Secure Boot and Trust Anchor on supported devices, Disable VPN web services if not essential, Monitor for unusual CLI command activity or syslog suppression, Deploy network segmentation to limit lateral movement, Conduct forensic analysis of ASA firmware for signs of RayInitiator/LINE VIPER, Implement behavioral detection for ICMP/TCP and WebVPN C2 traffic
Incident : Espionage CIS5802058092725
Recommendations: Immediate patching of Cisco ASA vulnerabilities as per vendor and cyber agency guidelines., Enhanced monitoring for signs of compromise, especially in legacy systems., Collaboration with cybersecurity agencies (e.g., CSE, CISA, NCSC) for threat intelligence sharing., Review and update incident response plans for state-sponsored APTs., Prioritize security updates for VPN and remote access infrastructure.Immediate patching of Cisco ASA vulnerabilities as per vendor and cyber agency guidelines., Enhanced monitoring for signs of compromise, especially in legacy systems., Collaboration with cybersecurity agencies (e.g., CSE, CISA, NCSC) for threat intelligence sharing., Review and update incident response plans for state-sponsored APTs., Prioritize security updates for VPN and remote access infrastructure.Immediate patching of Cisco ASA vulnerabilities as per vendor and cyber agency guidelines., Enhanced monitoring for signs of compromise, especially in legacy systems., Collaboration with cybersecurity agencies (e.g., CSE, CISA, NCSC) for threat intelligence sharing., Review and update incident response plans for state-sponsored APTs., Prioritize security updates for VPN and remote access infrastructure.Immediate patching of Cisco ASA vulnerabilities as per vendor and cyber agency guidelines., Enhanced monitoring for signs of compromise, especially in legacy systems., Collaboration with cybersecurity agencies (e.g., CSE, CISA, NCSC) for threat intelligence sharing., Review and update incident response plans for state-sponsored APTs., Prioritize security updates for VPN and remote access infrastructure.Immediate patching of Cisco ASA vulnerabilities as per vendor and cyber agency guidelines., Enhanced monitoring for signs of compromise, especially in legacy systems., Collaboration with cybersecurity agencies (e.g., CSE, CISA, NCSC) for threat intelligence sharing., Review and update incident response plans for state-sponsored APTs., Prioritize security updates for VPN and remote access infrastructure.
Incident : Vulnerability Exploitation CIS0692106093025
Recommendations: Immediately Patch CVE-2025-20333 and CVE-2025-20362 on All Cisco ASA/FTD Devices, Restrict Public Exposure of VPN Web Interfaces, Deploy Enhanced Monitoring for Suspicious HTTP Requests and VPN Logins, Disconnect End-of-Support (EoS) Devices from Networks, Follow CISA and NCSC Guidelines for Hardening Network Perimeters, Conduct Threat Hunting for 'Line Viper' and 'RayInitiator' MalwareImmediately Patch CVE-2025-20333 and CVE-2025-20362 on All Cisco ASA/FTD Devices, Restrict Public Exposure of VPN Web Interfaces, Deploy Enhanced Monitoring for Suspicious HTTP Requests and VPN Logins, Disconnect End-of-Support (EoS) Devices from Networks, Follow CISA and NCSC Guidelines for Hardening Network Perimeters, Conduct Threat Hunting for 'Line Viper' and 'RayInitiator' MalwareImmediately Patch CVE-2025-20333 and CVE-2025-20362 on All Cisco ASA/FTD Devices, Restrict Public Exposure of VPN Web Interfaces, Deploy Enhanced Monitoring for Suspicious HTTP Requests and VPN Logins, Disconnect End-of-Support (EoS) Devices from Networks, Follow CISA and NCSC Guidelines for Hardening Network Perimeters, Conduct Threat Hunting for 'Line Viper' and 'RayInitiator' MalwareImmediately Patch CVE-2025-20333 and CVE-2025-20362 on All Cisco ASA/FTD Devices, Restrict Public Exposure of VPN Web Interfaces, Deploy Enhanced Monitoring for Suspicious HTTP Requests and VPN Logins, Disconnect End-of-Support (EoS) Devices from Networks, Follow CISA and NCSC Guidelines for Hardening Network Perimeters, Conduct Threat Hunting for 'Line Viper' and 'RayInitiator' MalwareImmediately Patch CVE-2025-20333 and CVE-2025-20362 on All Cisco ASA/FTD Devices, Restrict Public Exposure of VPN Web Interfaces, Deploy Enhanced Monitoring for Suspicious HTTP Requests and VPN Logins, Disconnect End-of-Support (EoS) Devices from Networks, Follow CISA and NCSC Guidelines for Hardening Network Perimeters, Conduct Threat Hunting for 'Line Viper' and 'RayInitiator' MalwareImmediately Patch CVE-2025-20333 and CVE-2025-20362 on All Cisco ASA/FTD Devices, Restrict Public Exposure of VPN Web Interfaces, Deploy Enhanced Monitoring for Suspicious HTTP Requests and VPN Logins, Disconnect End-of-Support (EoS) Devices from Networks, Follow CISA and NCSC Guidelines for Hardening Network Perimeters, Conduct Threat Hunting for 'Line Viper' and 'RayInitiator' Malware
Incident : Ransomware CIS0702107111125
Recommendations: Monitor dark web forums for initial access brokerage activity targeting your industry., Implement multi-factor authentication (MFA) and least-privilege access to thwart initial access brokers., Regularly audit cryptocurrency transactions for signs of ransomware payments., Prepare for double-extortion tactics (data encryption + exfiltration) in ransomware response plans., Leverage threat intelligence sharing to identify emerging ransomware strains like Yanluowang.Monitor dark web forums for initial access brokerage activity targeting your industry., Implement multi-factor authentication (MFA) and least-privilege access to thwart initial access brokers., Regularly audit cryptocurrency transactions for signs of ransomware payments., Prepare for double-extortion tactics (data encryption + exfiltration) in ransomware response plans., Leverage threat intelligence sharing to identify emerging ransomware strains like Yanluowang.Monitor dark web forums for initial access brokerage activity targeting your industry., Implement multi-factor authentication (MFA) and least-privilege access to thwart initial access brokers., Regularly audit cryptocurrency transactions for signs of ransomware payments., Prepare for double-extortion tactics (data encryption + exfiltration) in ransomware response plans., Leverage threat intelligence sharing to identify emerging ransomware strains like Yanluowang.Monitor dark web forums for initial access brokerage activity targeting your industry., Implement multi-factor authentication (MFA) and least-privilege access to thwart initial access brokers., Regularly audit cryptocurrency transactions for signs of ransomware payments., Prepare for double-extortion tactics (data encryption + exfiltration) in ransomware response plans., Leverage threat intelligence sharing to identify emerging ransomware strains like Yanluowang.Monitor dark web forums for initial access brokerage activity targeting your industry., Implement multi-factor authentication (MFA) and least-privilege access to thwart initial access brokers., Regularly audit cryptocurrency transactions for signs of ransomware payments., Prepare for double-extortion tactics (data encryption + exfiltration) in ransomware response plans., Leverage threat intelligence sharing to identify emerging ransomware strains like Yanluowang.
What are the key lessons learned from past incidents ?
Key Lessons Learned: The key lessons learned from past incidents are The critical importance of maintaining updated systems and monitoring access control within corporate environments to prevent data breaches and maintain operational integrity.Proactive internal security testing can uncover critical vulnerabilities before exploitation (discovered by Brandon Sakai of Cisco).,Vulnerabilities in authentication systems (e.g., RADIUS) can have severe impacts if input validation is insufficient.,Lack of workarounds for critical flaws underscores the importance of patch management and alternative mitigation strategies (e.g., disabling vulnerable features).End-of-support (EoS) devices pose significant risks even if functional,Advanced threat actors leverage multi-stage malware (bootkits + shellcode loaders) to evade detection,Persistence mechanisms (e.g., ROMMON modifications) can survive reboots/upgrades on legacy hardware,VPN web services are a high-value target for APT groups,Secure Boot/Trust Anchor technologies are critical for mitigating firmware-level attacksProactive Patching is Critical for Zero-Day Vulnerabilities,Exposed VPN Interfaces Are High-Risk Targets,Federal Directives Can Accelerate Response in Critical Infrastructure,Threat Intelligence Sharing (e.g., Shadowserver, Greynoise) Provides Early WarningsInitial access brokers play a critical role in ransomware ecosystems, enabling attacks by selling pre-compromised access.,Threat actors often masquerade as other nationalities (e.g., Yanluowang posed as Chinese but was Russian).,Cryptocurrency tracing and digital breadcrumbs (e.g., email, Apple ID) are vital for attribution.,Collaboration between cybersecurity firms (Symantec, Kaspersky) and law enforcement (FBI) can disrupt ransomware operations.,Leaked internal chats can expose operational details and debunk threat actor personas.
What recommendations has the company implemented to improve cybersecurity ?
Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Collaboration with cybersecurity agencies (e.g., CSE, CISA, NCSC) for threat intelligence sharing., Immediate patching of Cisco ASA vulnerabilities as per vendor and cyber agency guidelines., Review and update incident response plans for state-sponsored APTs., Prioritize security updates for VPN and remote access infrastructure., Apply the patches as directed in the vendor's bulletin., Enhanced monitoring for signs of compromise and especially in legacy systems..
References
Where can I find more information about each incident ?
Incident : Ransomware CIS0217922
Source: BleepingComputer
Incident : Data Breach CIS747072825
Source: California Office of the Attorney General
Date Accessed: 2016-10-25
Incident : Remote Code Execution CIS905072925
Source: zerodayinitiative.com
Incident : Vulnerability Disclosure CIS751081525
Source: Cisco Security Advisory: CVE-2025-20265
Date Accessed: August 2025
Incident : Vulnerability Disclosure CIS751081525
Source: Cisco August 2025 Semiannual Security Advisory Bundled Publication
URL: https://sec.cloudapps.cisco.com/security/center/publicationListing.x
Date Accessed: August 2025
Incident : Zero-day exploitation CIS5262052092625
Source: U.K. National Cyber Security Centre (NCSC)
Date Accessed: 2025-09-25
Incident : Zero-day exploitation CIS5262052092625
Source: Cisco Security Advisory
Date Accessed: 2025-09
Incident : Zero-day exploitation CIS5262052092625
Source: Canadian Centre for Cyber Security Advisory
Date Accessed: 2025-09
Incident : Espionage CIS5802058092725
Source: CBC News
URL: https://www.cbc.ca/news/politics/cisco-cyberattack-cse-warning-1.7240000
Date Accessed: 2024-06-20
Incident : Espionage CIS5802058092725
Source: U.S. Cybersecurity and Infrastructure Security Agency (CISA) Emergency Directive
URL: https://www.cisa.gov/news-events/directives
Date Accessed: 2024-06-20
Incident : Espionage CIS5802058092725
Source: Canadian Centre for Cyber Security (CSE) Advisory
URL: https://cyber.gc.ca/en/guidance
Date Accessed: 2024-06-20
Incident : Espionage CIS5802058092725
Source: UK National Cyber Security Centre (NCSC) Warning
URL: https://www.ncsc.gov.uk/news
Date Accessed: 2024-06-20
Incident : Espionage CIS5802058092725
Source: Cisco Security Advisory (ArcaneDoor)
Date Accessed: 2024-06-20
Incident : Cyberattack CIS2032020092825
Source: Wired
Incident : Cyberattack CIS2032020092825
Source: CISA Directive (September 25, 2025)
Date Accessed: 2025-09-25
Incident : Vulnerability Exploitation CIS0692106093025
Source: Cisco Security Advisory (CVE-2025-20333)
URL: [1]
Date Accessed: 2024-09-25
Incident : Vulnerability Exploitation CIS0692106093025
Source: Cisco Security Advisory (CVE-2025-20362)
URL: [2]
Date Accessed: 2024-09-25
Incident : Vulnerability Exploitation CIS0692106093025
Source: The Shadowserver Foundation - Vulnerable Cisco ASA/FTD Scan Report
Date Accessed: 2024-09-29
Incident : Vulnerability Exploitation CIS0692106093025
Source: CISA Emergency Directive on Cisco ASA/FTD Vulnerabilities
Date Accessed: 2024-09-25
Incident : Vulnerability Exploitation CIS0692106093025
Source: UK NCSC Threat Report on Line Viper and RayInitiator Malware
Date Accessed: 2024-09-29
Incident : Vulnerability Exploitation CIS0692106093025
Source: Greynoise - Early Warning on Cisco ASA Scans
Date Accessed: 2024-09-04
Incident : Ransomware CIS0702107111125
Source: U.S. Department of Justice (Court Documents)
Date Accessed: 2025-10-29
Incident : Ransomware CIS0702107111125
Source: Seamus Hughes (Reporter, Unsealed Documents)
Incident : Ransomware CIS0702107111125
Source: Symantec (Yanluowang Discovery, 2021)
Date Accessed: 2021-10
Incident : Ransomware CIS0702107111125
Source: Kaspersky (Decrypter Release, 2022)
Date Accessed: 2022
Incident : Ransomware CIS0702107111125
Source: FBI Investigation (Cryptocurrency Tracing)
Incident : ransomware CIS2802228111125
Source: Court Watch (Seamus Hughes)
Incident : ransomware CIS2802228111125
Source: FBI affidavit (Special Agent Jeffrey Hunter)
Incident : ransomware CIS2802228111125
Source: Blockchain analysis (ransom payments)
Where can stakeholders find additional resources on cybersecurity best practices ?
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: BleepingComputer, and Source: California Office of the Attorney GeneralDate Accessed: 2016-10-25, and Source: zerodayinitiative.comUrl: https://www.zerodayinitiative.com, and Source: Cisco Security Advisory: CVE-2025-20265Url: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-KLJ98X7QDate Accessed: August 2025, and Source: Cisco August 2025 Semiannual Security Advisory Bundled PublicationUrl: https://sec.cloudapps.cisco.com/security/center/publicationListing.xDate Accessed: August 2025, and Source: U.K. National Cyber Security Centre (NCSC)Date Accessed: 2025-09-25, and Source: Cisco Security AdvisoryDate Accessed: 2025-09, and Source: Canadian Centre for Cyber Security AdvisoryDate Accessed: 2025-09, and Source: CBC NewsUrl: https://www.cbc.ca/news/politics/cisco-cyberattack-cse-warning-1.7240000Date Accessed: 2024-06-20, and Source: U.S. Cybersecurity and Infrastructure Security Agency (CISA) Emergency DirectiveUrl: https://www.cisa.gov/news-events/directivesDate Accessed: 2024-06-20, and Source: Canadian Centre for Cyber Security (CSE) AdvisoryUrl: https://cyber.gc.ca/en/guidanceDate Accessed: 2024-06-20, and Source: UK National Cyber Security Centre (NCSC) WarningUrl: https://www.ncsc.gov.uk/newsDate Accessed: 2024-06-20, and Source: Cisco Security Advisory (ArcaneDoor)Url: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-arcane-door-2024Date Accessed: 2024-06-20, and Source: BloombergDate Accessed: 2025-09-28, and Source: Wired, and Source: CISA Directive (September 25, 2025)Date Accessed: 2025-09-25, and Source: Cisco Security Advisory (CVE-2025-20333)Url: [1]Date Accessed: 2024-09-25, and Source: Cisco Security Advisory (CVE-2025-20362)Url: [2]Date Accessed: 2024-09-25, and Source: The Shadowserver Foundation - Vulnerable Cisco ASA/FTD Scan ReportDate Accessed: 2024-09-29, and Source: CISA Emergency Directive on Cisco ASA/FTD VulnerabilitiesDate Accessed: 2024-09-25, and Source: UK NCSC Threat Report on Line Viper and RayInitiator MalwareDate Accessed: 2024-09-29, and Source: Greynoise - Early Warning on Cisco ASA ScansDate Accessed: 2024-09-04, and Source: U.S. Department of Justice (Court Documents)Date Accessed: 2025-10-29, and Source: Seamus Hughes (Reporter, Unsealed Documents), and Source: Symantec (Yanluowang Discovery, 2021)Date Accessed: 2021-10, and Source: Kaspersky (Decrypter Release, 2022)Date Accessed: 2022, and Source: FBI Investigation (Cryptocurrency Tracing), and Source: Court Watch (Seamus Hughes), and Source: FBI affidavit (Special Agent Jeffrey Hunter), and Source: Blockchain analysis (ransom payments).
Investigation Status
What is the current status of the investigation for each incident ?
Incident : Vulnerability Disclosure CIS751081525
Investigation Status: Disclosed; No public exploitation reported. Internal discovery by Cisco.
Incident : Zero-day exploitation CIS5262052092625
Investigation Status: Ongoing (as of 2025-09-25)
Incident : Espionage CIS5802058092725
Investigation Status: Ongoing (CSE and international allies investigating scope and attribution)
Incident : Cyberattack CIS2032020092825
Investigation Status: Ongoing (CISA and Cisco involved)
Incident : Vulnerability Exploitation CIS0692106093025
Investigation Status: Ongoing (Active Exploitation Confirmed; Patching Underway)
Incident : Ransomware CIS0702107111125
Investigation Status: Ongoing (Plea deal signed 2025-11-25; sentencing pending)
Incident : ransomware CIS2802228111125
Investigation Status: ongoing (legal proceedings active, defendant pleaded guilty)
How does the company communicate the status of incident investigations to stakeholders ?
Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Public Advisory Via Cisco’S August 2025 Semiannual Security Advisory Bundled Publication, Urgent Recommendation For Immediate Patching, Public Advisories By Ncsc (2025-09-25), Cisco Security Bulletins, Canadian Centre For Cyber Security Alerts, Public Warnings By Cse (Canada), Cisa (U.S.), Ncsc (Uk), Media Statements (E.G., Cbc News), Collaboration With Five Eyes Alliance, Public Disclosure Via Bloomberg, Cisa Advisories, Cisco Security Advisories [1, 2], Cisa Emergency Directive and Ncsc Threat Report.
Stakeholder and Customer Advisories
Were there any advisories issued to stakeholders or customers for each incident ?
Incident : Vulnerability Disclosure CIS751081525
Stakeholder Advisories: Urgent Patching Recommended For All Affected Organizations..
Customer Advisories: Customers using Cisco Secure FMC with RADIUS enabled should apply updates or disable RADIUS immediately.
Incident : Zero-day exploitation CIS5262052092625
Stakeholder Advisories: Urgent Patching Recommended For All Affected Organizations, Government Agencies Advised To Audit Asa Devices.
Customer Advisories: Cisco PSIRT notificationsPublic security bulletins
Incident : Espionage CIS5802058092725
Stakeholder Advisories: Urgent Patching Directives For Federal Agencies (U.S.), Public Warnings For Critical Infrastructure Sectors (Canada, Uk, Five Eyes).
Customer Advisories: Cisco customer notifications (via security advisory)Guidance for organizations using Cisco ASA for VPNs
Incident : Cyberattack CIS2032020092825
Stakeholder Advisories: Cisa Directives To Federal Agencies, Public Statements By Chris Butera (Cisa).
Incident : Vulnerability Exploitation CIS0692106093025
Stakeholder Advisories: Cisco Customers, Federal Civilian Executive Branch (Fceb) Agencies, Global Organizations Using Cisco Asa/Ftd.
Customer Advisories: Apply Patches ImmediatelyMonitor for Indicators of Compromise (IoCs)Review VPN Access Logs for Unauthorized Activity
What advisories does the company provide to stakeholders and customers following an incident ?
Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Urgent Patching Recommended For All Affected Organizations., Customers Using Cisco Secure Fmc With Radius Enabled Should Apply Updates Or Disable Radius Immediately., , Urgent Patching Recommended For All Affected Organizations, Government Agencies Advised To Audit Asa Devices, Cisco Psirt Notifications, Public Security Bulletins, , Urgent Patching Directives For Federal Agencies (U.S.), Public Warnings For Critical Infrastructure Sectors (Canada, Uk, Five Eyes), Cisco Customer Notifications (Via Security Advisory), Guidance For Organizations Using Cisco Asa For Vpns, , Cisa Directives To Federal Agencies, Public Statements By Chris Butera (Cisa), Cisco Customers, Federal Civilian Executive Branch (Fceb) Agencies, Global Organizations Using Cisco Asa/Ftd, Apply Patches Immediately, Monitor For Indicators Of Compromise (Iocs), Review Vpn Access Logs For Unauthorized Activity and .
Initial Access Broker
How did the initial access broker gain entry for each incident ?
Incident : Unauthorized Access CIS205918123
Entry Point: Amazon Web Services
Incident : Advanced Persistent Threat (APT) CIS000082424
Entry Point: Cisco switches
Backdoors Established: VELVETSHELL malware
Incident : Vulnerability Exploitation CIS929041225
Entry Point: Smart Install Feature
High Value Targets: Telecommunications Providers
Data Sold on Dark Web: Telecommunications Providers
Incident : Zero-day exploitation CIS5262052092625
Entry Point: Cve-2025-20362 And Cve-2025-20333 In Cisco Asa Vpn Web Services,
Backdoors Established: ['RayInitiator (GRUB bootkit)', 'LINE VIPER (shellcode loader)', 'ROMMON modifications']
High Value Targets: Government Agencies, Vpn Authentication Systems, Cli Command History,
Data Sold on Dark Web: Government Agencies, Vpn Authentication Systems, Cli Command History,
Incident : Espionage CIS5802058092725
Entry Point: Vulnerabilities In Cisco Asa Devices (Legacy Systems Targeted),
Backdoors Established: Likely (malware implantation and command execution capabilities)
High Value Targets: Critical Infrastructure Sectors, Government, Academia, And Research Facilities,
Data Sold on Dark Web: Critical Infrastructure Sectors, Government, Academia, And Research Facilities,
Incident : Cyberattack CIS2032020092825
Entry Point: Cisco Asa/Ftd Vulnerabilities (Cve-2024-20353, Cve-2024-20359),
Reconnaissance Period: Since 2024 (ArcaneDoor group activity)
High Value Targets: U.S. Federal Cyber Infrastructure, Classified Government Documents,
Data Sold on Dark Web: U.S. Federal Cyber Infrastructure, Classified Government Documents,
Incident : Vulnerability Exploitation CIS0692106093025
Entry Point: Exposed Vpn Web Interfaces, Crafted Http Requests Targeting Cve-2025-20333/Cve-2025-20362,
Reconnaissance Period: Late August 2024 (Greynoise Scans)
Backdoors Established: ['Line Viper (Shellcode Loader)', 'RayInitiator (GRUB Bootkit)']
High Value Targets: Federal Agencies (Fceb), Critical Infrastructure, Enterprises With Sensitive Data,
Data Sold on Dark Web: Federal Agencies (Fceb), Critical Infrastructure, Enterprises With Sensitive Data,
Incident : Ransomware CIS0702107111125
Entry Point: Exploited Vulnerabilities (Unspecified), Potential Phishing,
Reconnaissance Period: July 2021 – November 2022
Backdoors Established: True
High Value Targets: Banks, Telecoms, Engineering Firms, Cisco, Walmart,
Data Sold on Dark Web: Banks, Telecoms, Engineering Firms, Cisco, Walmart,
Incident : ransomware CIS2802228111125
Entry Point: Corporate Network Breaches (Method Unspecified),
Backdoors Established: True
High Value Targets: U.S. Companies (8+), Cisco (Attempted),
Data Sold on Dark Web: U.S. Companies (8+), Cisco (Attempted),
Post-Incident Analysis
What were the root causes and corrective actions taken for each incident ?
Incident : Data Leak CIS1221121123
Root Causes: Erroneous Security Configuration
Incident : Advanced Persistent Threat (APT) CIS000082424
Root Causes: Zero-day vulnerability CVE-2024-20399
Incident : Security Vulnerabilities SPL355032725
Root Causes: Remote Code Execution (Rce) Through Malicious File Uploads, Unauthorized Disclosure Of Sensitive Information Through Privilege Escalation,
Corrective Actions: Patches And Updates Provided To Users,
Incident : Vulnerability Exploitation CIS929041225
Root Causes: Unpatched Systems
Incident : Remote Code Execution CIS905072925
Root Causes: Unsafe deserialization and command injection in the enableStrongSwanTunnel() method.
Corrective Actions: Update to 3.3 Patch 7 and 3.4 Patch 2
Incident : Vulnerability Disclosure CIS751081525
Root Causes: Insufficient Input Validation In Radius Authentication Subsystem., Improper Handling Of User-Supplied Credentials During Authentication.,
Corrective Actions: Released Patched Software Versions., Recommended Disabling Radius Authentication As A Temporary Mitigation.,
Incident : Zero-day exploitation CIS5262052092625
Root Causes: Exploitation Of Unpatched Zero-Day Vulnerabilities In Legacy Devices, Lack Of Secure Boot/Trust Anchor On Asa 5500-X Series, Use Of End-Of-Support Hardware In Critical Infrastructure, Insufficient Logging/Monitoring For Advanced Evasion Techniques,
Corrective Actions: Accelerated Eos Timelines For Vulnerable Devices, Enhanced Firmware Integrity Checks In Asa Software, Improved Detection For Bootkit-Level Persistence, Collaboration With Ncsc/Cccs For Threat Intelligence Sharing,
Incident : Espionage CIS5802058092725
Root Causes: Exploitation Of Unpatched Vulnerabilities In Cisco Asa, Targeting Of Legacy Systems, State-Sponsored Actor Sophistication,
Incident : Cyberattack CIS2032020092825
Root Causes: Unpatched Zero-Day Vulnerabilities In Cisco Devices, Insufficient Monitoring Of High-Value Targets,
Corrective Actions: Mandatory Vulnerability Assessments (Cisa Directive), Patch Management Enforcement,
Incident : Vulnerability Exploitation CIS0692106093025
Root Causes: Delayed Patching Of Zero-Day Vulnerabilities, Over-Exposure Of Vpn Interfaces To The Public Internet, Lack Of Temporary Mitigations (No Workarounds Available), Insufficient Monitoring For Early Indicators Of Exploitation,
Corrective Actions: Mandatory Patching Enforcement (E.G., Cisa Directive), Network Segmentation For Vpn Access Points, Enhanced Threat Detection For Malware (Line Viper, Rayinitiator), Accelerated End-Of-Support (Eos) Device Replacement,
Incident : Ransomware CIS0702107111125
Root Causes: Insufficient Network Segmentation Allowing Lateral Movement Post-Initial Access., Lack Of Detection For Initial Access Brokerage Activity., Vulnerabilities In Yanluowang’S Encryption Algorithm (Later Exploited By Kaspersky For Decrypter)., Use Of Cryptocurrency For Ransom Payments Enabling Anonymity.,
Corrective Actions: Fbi Disruption Of Yanluowang Operations Via Arrest/Extradition Of Volkov., Kaspersky’S Public Release Of A Free Decrypter (2022)., Heightened Scrutiny Of Russian-Linked Threat Actors Masquerading As Other Nationalities., Emphasis On Tracing Cryptocurrency Transactions For Attribution.,
Incident : ransomware CIS2802228111125
Root Causes: Initial Access Brokerage Enabling Ransomware Deployment, Credential Theft/Exploitation, Potential Vulnerabilities In Corporate Networks,
What is the company's process for conducting post-incident analysis ?
Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as U.K. National Cyber Security Centre (Ncsc), Canadian Centre For Cyber Security, , Recommended For Asa/Ftd Devices, , Five Eyes Intelligence Alliance, Cisco Internal Teams, , Recommended (implied by urgency of patching and detection evasion concerns), Cisco Cybersecurity Experts, , Use Of Cisa Cybersecurity Tools For Threat Assessment, , The Shadowserver Foundation (Threat Monitoring), Greynoise (Early Warning Scans), , Monitor For Crafted Http Requests, Track Suspicious Vpn Logins, , Fbi Investigation, Symantec (Threat Intelligence), Kaspersky (Decryption Tool), , Fbi, International Law Enforcement (Italy), .
What corrective actions has the company taken based on post-incident analysis ?
Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Patches And Updates Provided To Users, , Update to 3.3 Patch 7 and 3.4 Patch 2, Released Patched Software Versions., Recommended Disabling Radius Authentication As A Temporary Mitigation., , Accelerated Eos Timelines For Vulnerable Devices, Enhanced Firmware Integrity Checks In Asa Software, Improved Detection For Bootkit-Level Persistence, Collaboration With Ncsc/Cccs For Threat Intelligence Sharing, , Mandatory Vulnerability Assessments (Cisa Directive), Patch Management Enforcement, , Mandatory Patching Enforcement (E.G., Cisa Directive), Network Segmentation For Vpn Access Points, Enhanced Threat Detection For Malware (Line Viper, Rayinitiator), Accelerated End-Of-Support (Eos) Device Replacement, , Fbi Disruption Of Yanluowang Operations Via Arrest/Extradition Of Volkov., Kaspersky’S Public Release Of A Free Decrypter (2022)., Heightened Scrutiny Of Russian-Linked Threat Actors Masquerading As Other Nationalities., Emphasis On Tracing Cryptocurrency Transactions For Attribution., .
Additional Questions
General Information
Has the company ever paid ransoms ?
Ransom Payment History: The company has Paid ransoms in the past.
What was the amount of the last ransom demanded ?
Last Ransom Demanded: The amount of the last ransom demanded was $1.5M+ (confirmed from two victims).
Who was the attacking group in the last incident ?
Last Attacking Group: The attacking group in the last incident were an Yanluowang ransomware gang, Yanluowang Ransomware Gang, Sudhish Kasaba Ramesh, Velvet Ant, Salt Typhoon, ArcaneDoorUAT4356Storm-1849Suspected China-linked state-sponsored group, State-sponsored actor (high confidence; linked to ArcaneDoor campaign), ArcaneDoor Hacker GroupRussian Hackers (for federal courts breach), Name: Aleksey Olegovich Volkov (aka 'chubaka.kor')Affiliation: ['Yanluowang Ransomware Gang', 'LockBit Ransomware Gang (alleged communication)']Nationality: RussianRole: Initial Access BrokerAliases: ['chubaka.kor', 'Alekseq Olegovi3 Volkov']Birthdate: 2000-03-20Cryptocurrency Wallets: ['Linked to Russian passport-verified account']Email: [email protected] Id: [email protected], Name: Aleksey Olegovich VolkovAliases: ['chubaka.kor', 'nets', '[email protected]', '[email protected]']Affiliation: ['Yanluowang ransomware group', 'potential link to LockBit ransomware gang']Nationality: RussianStatus: arrested (January 2024), extradited to U.S., pleaded guilty (October 29 and 2024).
Incident Details
What was the most recent incident detected ?
Most Recent Incident Detected: The most recent incident detected was on 2018-09-24.
What was the most recent incident publicly disclosed ?
Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2024-10-29.
What was the most recent incident resolved ?
Most Recent Incident Resolved: The most recent incident resolved was on 2025-07-22.
Impact of the Incidents
What was the highest financial loss from an incident ?
Highest Financial Loss: The highest financial loss from an incident was $2,400,000.
What was the most significant data compromised in an incident ?
Most Significant Data Compromised: The most significant data compromised in an incident were Cisco products or services, Sensitive customer data, Sensitive employee information, Intellectual property, Supply chain operations, , non-sensitive files, classified documents, technical schematics, source code, , name, password, email address, phone number, security question answers, professional profile, educational background, cover letter, resume content, , Sensitive Data, names, addresses, emails, phone numbers, other sensitive data, , Potential exfiltration from government agencies, VPN credentials (via AAA bypass), CLI commands (harvested), Packet captures, , Classified documents (espionage, fraud, money laundering, foreign agent activities), and .
What was the most significant system affected in an incident ?
Most Significant System Affected: The most significant system affected in an incident were Cisco Small Business RV Series routers and 16,000 WebEx Teams accounts456 virtual machines and and and Splunk EnterpriseSplunk Cloud PlatformSplunk Secure Gateway app and and Cisco Professional Careers mobile website and and Cisco Secure Firewall Management Center (FMC) Software (versions 7.0.7, 7.7.0 with RADIUS enabled) and Cisco ASA 5500-X Series (5512-X, 5515-X, 5525-X, 5545-X, 5555-X, 5585-X)Devices running Cisco ASA Software 9.12 or 9.14 with VPN web services enabled and Cisco Adaptive Security Appliances (ASA)VPN-enabled systems used by remote workers and Cisco Adaptive Security Appliance (ASA)Firepower Threat Defense (FTD) softwareHundreds of Cisco firewall devicesU.S. federal courts computer systems and and .
Response to the Incidents
What third-party assistance was involved in the most recent incident ?
Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was u.k. national cyber security centre (ncsc), canadian centre for cyber security, , five eyes intelligence alliance, cisco internal teams, , cisco cybersecurity experts, , the shadowserver foundation (threat monitoring), greynoise (early warning scans), , fbi investigation, symantec (threat intelligence), kaspersky (decryption tool), , fbi, international law enforcement (italy), .
What containment measures were taken in the most recent incident ?
Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were Took action to contain and eradicate the bad actors, Apply security updates, Disable RADIUS authentication (switch to LDAP/SAML/local accounts), Cisco patches for CVE-2025-20362, CVE-2025-20333, CVE-2025-20363Urgent advisories for updatesDisabling VPN web services on vulnerable devices, Urgent Patching of Cisco ASA VulnerabilitiesEmergency Directives (e.g., U.S. CISA's midnight deadline for federal agencies), CISA directive to identify affected devicesData collection and threat assessment using CISA tools and Restrict VPN Web Interface ExposureDisconnect End-of-Support (EoS) ASA DevicesIncrease Logging/Monitoring for Suspicious VPN Logins.
Data Breach Information
What was the most sensitive data compromised in a breach ?
Most Sensitive Data Compromised: The most sensitive data compromised in a breach were professional profile, Supply chain operations, Potential exfiltration from government agencies, password, security question answers, addresses, other sensitive data, technical schematics, phone number, VPN credentials (via AAA bypass), Packet captures, phone numbers, educational background, CLI commands (harvested), resume content, Sensitive Data, Classified documents (espionage, fraud, money laundering, foreign agent activities), name, Intellectual property, non-sensitive files, cover letter, classified documents, Sensitive customer data, names, Sensitive employee information, emails, source code, Cisco products or services and email address.
Ransomware Information
Regulatory Compliance
What was the most significant legal action taken for a regulatory violation ?
Most Significant Legal Action: The most significant legal action taken for a regulatory violation was U.S. Federal Charges (hacking, theft, extortion), Plea Deal (2025-10-29), Extradition from Italy (2023), , arrest (Italy, January 2024), extradition to U.S., guilty plea (October 29, 2024), charges: unlawful transfer of means of identification, trafficking in access information, access device fraud, aggravated identity theft, conspiracy to commit computer fraud, conspiracy to commit money laundering, .
Lessons Learned and Recommendations
What was the most significant lesson learned from past incidents ?
Most Significant Lesson Learned: The most significant lesson learned from past incidents was Leaked internal chats can expose operational details and debunk threat actor personas.
What was the most significant recommendation implemented to improve cybersecurity ?
Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Implement behavioral detection for ICMP/TCP and WebVPN C2 traffic, Deploy network segmentation to limit lateral movement, Disconnect End-of-Support (EoS) Devices from Networks, Immediately patch affected Cisco Secure FMC Software (versions 7.0.7, 7.7.0) to the latest release., Disable RADIUS authentication if patching is not immediately feasible, and switch to LDAP, SAML SSO, or local accounts., Replace end-of-support Cisco ASA 5500-X Series devices, Prepare for double-extortion tactics (data encryption + exfiltration) in ransomware response plans., Regularly audit cryptocurrency transactions for signs of ransomware payments., Monitor for unusual CLI command activity or syslog suppression, Leverage threat intelligence sharing to identify emerging ransomware strains like Yanluowang., Prioritize this vulnerability as a 'priority-one' patching scenario due to its critical severity (CVSS 10.0) and potential for unauthenticated remote code execution., Follow CISA and NCSC Guidelines for Hardening Network Perimeters, Collaboration with cybersecurity agencies (e.g., CSE, CISA, NCSC) for threat intelligence sharing., Monitor dark web forums for initial access brokerage activity targeting your industry., Immediate patching of Cisco ASA vulnerabilities as per vendor and cyber agency guidelines., Review and update incident response plans for state-sponsored APTs., Immediately patch CVE-2025-20362, CVE-2025-20333, and CVE-2025-20363, Conduct a review of all authentication mechanisms in enterprise firewall infrastructure to identify similar input validation risks., Conduct Threat Hunting for 'Line Viper' and 'RayInitiator' Malware, Implement multi-factor authentication (MFA) and least-privilege access to thwart initial access brokers., Disable VPN web services if not essential, Enable Secure Boot and Trust Anchor on supported devices, Monitor for unusual authentication attempts or command execution on FMC systems until patches are applied., Deploy Enhanced Monitoring for Suspicious HTTP Requests and VPN Logins, Immediately Patch CVE-2025-20333 and CVE-2025-20362 on All Cisco ASA/FTD Devices, Restrict Public Exposure of VPN Web Interfaces, Prioritize security updates for VPN and remote access infrastructure., Conduct forensic analysis of ASA firmware for signs of RayInitiator/LINE VIPER, Apply the patches as directed in the vendor's bulletin., Enhanced monitoring for signs of compromise and especially in legacy systems..
References
What is the most recent source of information about an incident ?
Most Recent Source: The most recent source of information about an incident are Cisco August 2025 Semiannual Security Advisory Bundled Publication, California Office of the Attorney General, Bloomberg, Canadian Centre for Cyber Security Advisory, BleepingComputer, Symantec (Yanluowang Discovery, 2021), U.K. National Cyber Security Centre (NCSC), zerodayinitiative.com, Kaspersky (Decrypter Release, 2022), Greynoise - Early Warning on Cisco ASA Scans, Cisco Security Advisory (CVE-2025-20362), The Shadowserver Foundation - Vulnerable Cisco ASA/FTD Scan Report, FBI affidavit (Special Agent Jeffrey Hunter), Blockchain analysis (ransom payments), Wired, UK NCSC Threat Report on Line Viper and RayInitiator Malware, CISA Directive (September 25, 2025), Court Watch (Seamus Hughes), Canadian Centre for Cyber Security (CSE) Advisory, FBI Investigation (Cryptocurrency Tracing), Cisco Security Advisory (CVE-2025-20333), Cisco Security Advisory (ArcaneDoor), CBC News, U.S. Department of Justice (Court Documents), CISA Emergency Directive on Cisco ASA/FTD Vulnerabilities, Cisco Security Advisory: CVE-2025-20265, U.S. Cybersecurity and Infrastructure Security Agency (CISA) Emergency Directive, Cisco Security Advisory, UK National Cyber Security Centre (NCSC) Warning, Seamus Hughes (Reporter and Unsealed Documents).
What is the most recent URL for additional resources on cybersecurity best practices ?
Most Recent URL for Additional Resources: The most recent URL for additional resources on cybersecurity best practices is https://www.zerodayinitiative.com, https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-KLJ98X7Q, https://sec.cloudapps.cisco.com/security/center/publicationListing.x, https://www.cbc.ca/news/politics/cisco-cyberattack-cse-warning-1.7240000, https://www.cisa.gov/news-events/directives, https://cyber.gc.ca/en/guidance, https://www.ncsc.gov.uk/news, https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-arcane-door-2024, [1], [2] .
Investigation Status
What is the current status of the most recent investigation ?
Current Status of Most Recent Investigation: The current status of the most recent investigation is Disclosed; No public exploitation reported. Internal discovery by Cisco..
Stakeholder and Customer Advisories
What was the most recent stakeholder advisory issued ?
Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was Urgent patching recommended for all affected organizations., Urgent patching recommended for all affected organizations, Government agencies advised to audit ASA devices, Urgent patching directives for federal agencies (U.S.), Public warnings for critical infrastructure sectors (Canada, UK, Five Eyes), CISA directives to federal agencies, Public statements by Chris Butera (CISA), Cisco Customers, Federal Civilian Executive Branch (FCEB) Agencies, Global Organizations Using Cisco ASA/FTD, .
What was the most recent customer advisory issued ?
Most Recent Customer Advisory: The most recent customer advisory issued were an Customers using Cisco Secure FMC with RADIUS enabled should apply updates or disable RADIUS immediately., Cisco PSIRT notificationsPublic security bulletins, Cisco customer notifications (via security advisory)Guidance for organizations using Cisco ASA for VPNs and Apply Patches ImmediatelyMonitor for Indicators of Compromise (IoCs)Review VPN Access Logs for Unauthorized Activity.
Initial Access Broker
What was the most recent entry point used by an initial access broker ?
Most Recent Entry Point: The most recent entry point used by an initial access broker were an Amazon Web Services, Smart Install Feature and Cisco switches.
What was the most recent reconnaissance period for an incident ?
Most Recent Reconnaissance Period: The most recent reconnaissance period for an incident was Since 2024 (ArcaneDoor group activity), Late August 2024 (Greynoise Scans), July 2021 – November 2022.
Post-Incident Analysis
What was the most significant root cause identified in post-incident analysis ?
Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Erroneous Security Configuration, Zero-day vulnerability CVE-2024-20399, Remote Code Execution (RCE) through malicious file uploadsUnauthorized disclosure of sensitive information through privilege escalation, Unpatched Systems, Unsafe deserialization and command injection in the enableStrongSwanTunnel() method., Insufficient input validation in RADIUS authentication subsystem.Improper handling of user-supplied credentials during authentication., Exploitation of unpatched zero-day vulnerabilities in legacy devicesLack of Secure Boot/Trust Anchor on ASA 5500-X SeriesUse of end-of-support hardware in critical infrastructureInsufficient logging/monitoring for advanced evasion techniques, Exploitation of unpatched vulnerabilities in Cisco ASATargeting of legacy systemsState-sponsored actor sophistication, Unpatched zero-day vulnerabilities in Cisco devicesInsufficient monitoring of high-value targets, Delayed Patching of Zero-Day VulnerabilitiesOver-Exposure of VPN Interfaces to the Public InternetLack of Temporary Mitigations (No Workarounds Available)Insufficient Monitoring for Early Indicators of Exploitation, Insufficient network segmentation allowing lateral movement post-initial access.Lack of detection for initial access brokerage activity.Vulnerabilities in Yanluowang’s encryption algorithm (later exploited by Kaspersky for decrypter).Use of cryptocurrency for ransom payments enabling anonymity., initial access brokerage enabling ransomware deploymentcredential theft/exploitationpotential vulnerabilities in corporate networks.
What was the most significant corrective action taken based on post-incident analysis ?
Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Patches and updates provided to users, Update to 3.3 Patch 7 and 3.4 Patch 2, Released patched software versions.Recommended disabling RADIUS authentication as a temporary mitigation., Accelerated EoS timelines for vulnerable devicesEnhanced firmware integrity checks in ASA softwareImproved detection for bootkit-level persistenceCollaboration with NCSC/CCCS for threat intelligence sharing, Mandatory vulnerability assessments (CISA directive)Patch management enforcement, Mandatory Patching Enforcement (e.g., CISA Directive)Network Segmentation for VPN Access PointsEnhanced Threat Detection for Malware (Line Viper, RayInitiator)Accelerated End-of-Support (EoS) Device Replacement, FBI disruption of Yanluowang operations via arrest/extradition of Volkov.Kaspersky’s public release of a free decrypter (2022).Heightened scrutiny of Russian-linked threat actors masquerading as other nationalities.Emphasis on tracing cryptocurrency transactions for attribution..
.png)
Latest Global CVEs (Not Company-Specific)
Description
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions prior to 16.0.96 and 17.0.1 through 17.0.9 have a weak default password. By default, this is a 6 digit numeric value which can be brute forced. (This is the app_password parameter). Depending on local configuration, this password could be the extension, voicemail, user manager, DPMA or EPM phone admin password. This issue is fixed in versions 16.0.96 and 17.0.10.
Risk Information
cvss4
Base: 6.9
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
Neuron is a PHP framework for creating and orchestrating AI Agents. In versions 2.8.11 and below, the MySQLWriteTool executes arbitrary SQL provided by the caller using PDO::prepare() + execute() without semantic restrictions. This is consistent with the name (“write tool”), but in an LLM/agent context it becomes a high-risk capability: prompt injection or indirect prompt manipulation can cause execution of destructive queries such as DROP TABLE, TRUNCATE, DELETE, ALTER, or privilege-related statements (subject to DB permissions). Deployments that expose an agent with MySQLWriteTool enabled to untrusted input and/or run the tool with a DB user that has broad privileges are impacted. This issue is fixed in version 2.8.12.
Risk Information
cvss3
Base: 9.4
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Description
Neuron is a PHP framework for creating and orchestrating AI Agents. Versions 2.8.11 and below use MySQLSelectTool, which is vulnerable to Read-Only Bypass. MySQLSelectTool is intended to be a read-only SQL tool (e.g., for LLM agent querying, however, validation based on the first keyword (e.g., SELECT) and a forbidden-keyword list does not block file-writing constructs such as INTO OUTFILE / INTO DUMPFILE. As a result, an attacker who can influence the tool input (e.g., via prompt injection through a public agent endpoint) may write arbitrary files to the DB server if the MySQL/MariaDB account has the FILE privilege and server configuration permits writes to a useful location (e.g., a web-accessible directory). This issue is fixed in version 2.8.12.
Risk Information
cvss3
Base: 8.2
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Description
Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another request’s response. This issue is fixed in version 20.0.1.
Risk Information
cvss3
Base: 8.4
Severity: HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Description
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. When using versions 4.11.0 through 4.11.2 and 4.12.0, simultaneous requests on the same client may result in improper lookups in the TokenRequestCache for the request results. This issue is fixed in versions 4.11.2 and 4.12.1.
Risk Information
cvss3
Base: 5.4
Severity: HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N
Access Data Using Our API
Get company history
curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=cisco' -H 'apikey: YOUR_API_KEY_HERE'
RapidWhat Do We Measure ?
Incident
Finding
Grade
Digital Assets
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
These are some of the factors we use to calculate the overall score:
Network Security
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
SBOM (Software Bill of Materials)
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
CMDB (Configuration Management Database)
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Threat Intelligence
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.
Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.
