Cisco Talos shares insights related to recent cyber attack on Cisco
Summary: Cisco Talos reported that an attacker gained initial access to Cisco's VPN by compromising a Cisco employee's personal Google account, where Chrome password syncing had stored the employee's Cisco credentials, then used vishing and MFA fatigue to bypass multifactor authentication and enrolled new devices for MFA. The actor escalated to administrative privileges, moved into the Citrix environment and domain controllers, dumped NTDS with ntdsutil.exe and exfiltrated it over SMB, dropped tools including Cobalt Strike, Mimikatz, Impacket, LogMeIn and TeamViewer, and created a local administrator account named "z".
Key Takeaway: The only confirmed exfiltration was a Box folder tied to the compromised employee's account and employee authentication data from Active Directory, and in the weeks after eviction the attacker kept trying to regain VPN access by guessing single-character password changes made after Cisco's company-wide reset.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026