Cisco
Company Details
Linkedin ID:
cisco
Website:
Employees number:
94,948
Number of followers:
6,981,104
NAICS:
5112
Industry Type:
Homepage:
cisco.com
IP Addresses:
1
Company ID:
CIS_2976377
Scan Status:
Completed
Cisco Company CyberSecurity Posture
cisco.com
Cisco is the worldwide technology leader that is revolutionizing the way organizations connect and protect in the AI era. For more than 40 years, Cisco has securely connected the world. With its industry leading AI-powered solutions and services, Cisco enables its customers, partners and communities to unlock innovation, enhance productivity and strengthen digital resilience. With purpose at its core, Cisco remains committed to creating a more connected and inclusive future for all.
Cisco A.I CyberSecurity Scoring
Cisco Risk Score (AI oriented)Between 550 and 599
Cisco
Updated:
- Powered by our proprietary A.I cyber incident model
- Insurance preferes TPRM score to calculate premium
Cisco Global Score (TPRM)XXXX
Cisco
- Instant access to detailed risk factors
- Benchmark vs. industry & size peers
- Vulnerabilities
- Findings
Cisco Company CyberSecurity News & History
Past Incidents
30
Attack Types
5
Cisco Systems, Inc.
Breach
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: The California Office of the Attorney General reported on October 25, 2016, that Cisco Systems, Inc. experienced a data breach on August 18, 2016. The breach involved a security setting error on the Cisco Professional Careers mobile website, potentially exposing job application-related personal information including names, addresses, emails, phone numbers, and other sensitive data. Approximately individuals were affected.
Cisco
Breach
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: A former Cisco employee accessed the company's cloud infrastructure in 2018, five months after resigning, to deploy code that led to the shutdown of more than 16,000 WebEx Teams accounts and the deletion of 456 virtual machines. 30-year-old Sudhish Kasaba Ramesh accessed Cisco's cloud infrastructure hosted on Amazon Web Services without permission on September 24, 2018. The shutdown forced Cisco to spend more than $2,400,000 in customer refunds and employee time needed to restore the damage caused by Ramesh.
Cisco
Breach
Rankiteo Explanation
Attack threatening the organization's existence
Description: Cisco has was targeted in a data leaked by the Yanluowang ransomware gang in September 2022. The gang leaked the data that was stolen from the company network during a cyberattack in May. The stolen data included non-sensitive files from the employee’s Box folder and thousands of files amounting to 55GB and that the cache included classified documents, technical schematics, and source code.
Cisco
Cyber Attack
Rankiteo Explanation
Attack threatening the organization's existence
Description: Government cyber agencies globally, including Canada’s CSE and the U.S. CISA, have issued urgent warnings about a sophisticated **state-sponsored espionage campaign** (ArcaneDoor) exploiting vulnerabilities in **Cisco’s Adaptive Security Appliances (ASA)**, widely used for VPNs by remote workers and critical infrastructure. The attackers implanted malware, executed commands, and potentially **exfiltrated data** from compromised devices, targeting legacy systems with high evasion capabilities. The U.S. mandated federal agencies to patch vulnerabilities within 24 hours, labeling the threat as **significant risk to victim networks**. The UK’s NCSC noted the malware’s **evolution in sophistication**, while Cisco confirmed the actor’s focus on espionage. Critical sectors—governments, academia, and research facilities—were urged to act immediately. The attack’s scope remains under investigation, but its **advanced persistence mechanisms** and potential for **data theft from high-value targets** (e.g., state secrets, intellectual property) pose severe operational and national security risks. The campaign’s **targeting of VPN infrastructure** could enable lateral movement into broader networks, amplifying the threat to organizational integrity and confidentiality.
Cisco
Cyber Attack
Rankiteo Explanation
Attack threatening the organization's existence
Description: CISCO got hit and they immediately took control of the story. The threat actors posted a directory of Drive C on their leak site. The directory listed 3,176 files, comprising 2,875,897,023 bytes in 2111 Directories. That information matches was sent as a tip. It was determined that a Cisco employee’s credentials were compromised after an attacker gained control of a personal Google account where credentials saved in the victim’s browser were being synchronized. The attacker conducted a series of sophisticated voice phishing attacks under the guise of various trusted organizations attempting to convince the victim to accept multi-factor authentication (MFA) push notifications initiated by the attacker. The attacker succeeded in achieving an MFA push acceptance which grant them access to VPN in the context of the targeted user.
Cisco
Cyber Attack
Rankiteo Explanation
Attack that could bring to a war
Description: The **U.K. National Cyber Security Centre (NCSC)** disclosed that **state-sponsored threat actors (UAT4356/Storm-1849, linked to China)** exploited **zero-day vulnerabilities (CVE-2025-20362, CVE-2025-20333)** in **Cisco ASA 5500-X Series firewalls** to deploy **previously undocumented malware (RayInitiator, LINE VIPER)**. The attack targeted **multiple government agencies**, enabling **persistent access, command execution, data exfiltration, and forensic evasion** by modifying the **ROMMON bootloader** and disabling logging. The compromised devices—**end-of-support (EoS) models lacking Secure Boot**—were vulnerable to **full system takeover**, including **root-level arbitrary code execution**. The campaign demonstrated **advanced operational security**, with malware designed to **survive reboots, suppress syslogs, and bypass VPN authentication**. While no direct evidence confirmed **large-scale data breaches**, the **targeting of government infrastructure** and **use of nation-state tools** suggest **high strategic impact**, potentially threatening **national security, critical services, and diplomatic stability**. The attack’s **sophistication and persistence mechanisms** indicate a **long-term espionage or sabotage intent**, with risks extending beyond Cisco to **broader supply-chain and geopolitical consequences**.
Cisco
Cyber Attack
Rankiteo Explanation
Attack threatening the economy of geographical region
Description: Hackers, specifically the **ArcaneDoor** group linked to Russian state actors, exploited zero-day vulnerabilities (CVE-2024-20353 and CVE-2024-20359) in **Cisco’s Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)** software—critical components of U.S. federal cyber infrastructure. The breach, detected on **September 26, 2025**, allowed attackers to execute **remote denial-of-service (DoS) attacks** via infinite loops and **escalate privileges from administrator to root access**, compromising hundreds of Cisco firewall devices used by U.S. government agencies. Classified documents were stolen, including intelligence on **espionage, fraud, money laundering, and foreign agent activities**, directly threatening national security. The attack follows a 2024 pattern where Cisco’s systems were repeatedly targeted, with CISA issuing emergency directives to mitigate further damage. The incident underscores systemic vulnerabilities in federal cyber defenses, with experts warning of escalating threats as other cybercriminal groups adopt ArcaneDoor’s tactics.
Cisco
Data Leak
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: Cisco has addressed a security flaw that allowed personal data to leak from the company's Professional Careers portal. Cisco clarifies that just a small amount of information connected to job applications was stolen from the mobile version of the website in its email notification of the issue to the impacted individuals. As to the security alert distributed by Cisco to its users, an erroneous security configuration on a third-party site following system repair was the cause of data leaking. The information leaked by Cisco comprises personal details such as name, password, email address, phone number, security question answers, professional profile and educational background, cover letter, resume content, and other details.
Cisco
Ransomware
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: Cisco hacked by Yanluowang ransomware gang, 2.8GB allegedly stolen. The compromised information includes cisco products or services, sensitive customer data or sensitive employee information, intellectual property, or supply chain operations. A redacted NDA agreement that was obtained in the attack was also supplied to BleepingComputer by the threat actors as evidence of the incident and a "hint" that they had infiltrated Cisco's network and taken files. They immediately took action to contain and eradicate the bad actors.
Cisco
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Cisco, a leading technology company known for its cybersecurity and incident response services through Cisco Talos, experienced a significant ransomware attack on May 24, 2022. The ransomware group identified as Yanluowang was able to gain access to an employee’s credentials via a compromised personal Google account. This breach allowed the attackers to infiltrate Cisco’s systems, representing a severe security incident for the company. Although Cisco is renowned for its robust security measures, the attack highlights the sophisticated techniques employed by ransomware gangs to target and compromise even the most secure entities. The company embarked on a comprehensive response to mitigate the impact of the attack, demonstrating the importance of preparedness and swift action in the face of ransomware threats. The incident underscores the ongoing challenges organizations face in protecting against the evolving landscape of cyber threats and the necessity for continuous enhancement of cybersecurity protocols.
Cisco
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: In May 2022, Cisco fell victim to a **Yanluowang ransomware attack** orchestrated by Aleksey Olegovich Volkov, an initial access broker (IAB) who breached the company’s network by compromising a **Cisco employee’s Box folder**. While the attackers exfiltrated **non-sensitive files**, they failed to encrypt Cisco’s systems or successfully extort a ransom. However, the incident exposed critical vulnerabilities in Cisco’s security posture, revealing that threat actors could infiltrate corporate networks, steal credentials, and potentially deploy ransomware. The attack was part of a broader campaign targeting at least **eight U.S. companies**, with Volkov selling network access to Yanluowang operators, who then demanded ransoms ranging from **$300,000 to $15 million**. Although Cisco avoided financial loss or data encryption in this instance, the breach underscored the risks of **supply-chain attacks, credential theft, and ransomware-as-a-service (RaaS) operations**. The FBI’s investigation later tied Volkov to **LockBit ransomware** as well, highlighting his role in facilitating high-impact cybercrime.
Cisco
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Cisco, a multinational technology conglomerate, was targeted by the **Yanluowang ransomware gang** in a sophisticated attack facilitated by Aleksey Volkov, an initial access broker. The group exploited network vulnerabilities to infiltrate Cisco’s systems, deploying ransomware that encrypted critical data and disrupted operations. While the article does not specify the exact financial or data losses Cisco incurred, the broader context of Yanluowang’s operations—including extortion demands, DDoS attacks, and threats to executives—suggests severe operational and reputational harm. The gang’s tactics often involved stealing sensitive corporate or customer data before encrypting systems, then demanding ransom payments under threat of public exposure or prolonged outages. Cisco’s inclusion among high-profile victims (alongside Walmart) underscores the attack’s strategic intent to cripple infrastructure and extract maximum financial gain. The involvement of a Russian national linked to defense ministry ties further elevates the attack’s geopolitical and cybersecurity significance, aligning with Yanluowang’s pattern of targeting Western enterprises with precision.
Cisco
Vulnerability
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: A critical security vulnerability (CVE-2025-20341) was discovered in the **Cisco Catalyst Center Virtual Appliance** running on **VMware ESXi**, allowing authenticated attackers with **Observer-level credentials** to escalate privileges to **Administrator** via crafted HTTP requests. The flaw stems from insufficient input validation, enabling unauthorized system modifications such as creating new accounts or elevating privileges. While no evidence of exploitation exists yet, the vulnerability poses a severe risk as it **expands the attack surface**—no initial admin access is required, and **no workarounds** are available. Affected versions include **2.3.7.3-VA and later (excluding 3.1)**, requiring an urgent upgrade to **2.3.7.10-VA or newer**. The issue was internally identified by Cisco’s TAC, emphasizing the need for immediate patching to prevent potential privilege abuse and administrative compromise. Failure to act could lead to **unauthorized control over critical network infrastructure**, though no data breaches or financial losses have been reported to date.
Cisco Systems
Vulnerability
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: A critical vulnerability in **Cisco Secure Firewall Management Center (FMC) Software** (affecting versions **7.0.7 and 7.7.0**) exposes organizations using **RADIUS authentication** for web-based or SSH management interfaces to remote attacks. The flaw stems from improper input validation during authentication, allowing attackers to inject malicious payloads when submitting credentials to the RADIUS server. Successful exploitation grants **high-privilege command execution**, potentially enabling attackers to **bypass security controls, manipulate firewall configurations, or pivot into deeper network infiltration**.While no active exploits or data breaches have been reported yet, the vulnerability poses a severe risk if left unpatched. Attackers could leverage it to **compromise administrative credentials, alter security policies, or exfiltrate sensitive data** passing through the firewall. The urgency of patching is underscored by Cisco’s warning, as unmitigated exposure could lead to **lateral movement within corporate networks**, escalating into broader system compromises. Organizations relying on FMC for network authentication are advised to apply the patch immediately to prevent potential **unauthorized access or privilege escalation** by threat actors.
Cisco
Vulnerability
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: Cisco disclosed a **high-severity zero-day vulnerability (CVE-2025-20352)** in its **IOS and IOS XE Software**, actively exploited in the wild. The flaw, a **stack-based buffer overflow** in the **SNMP subsystem**, allows **authenticated remote attackers with low privileges** to trigger **denial-of-service (DoS)** conditions on unpatched devices. High-privileged attackers can **execute arbitrary code as root**, gaining full system control. Exploitation occurs via **crafted SNMP packets** over IPv4/IPv6, with confirmed cases where **local administrator credentials were compromised**.The vulnerability affects **all devices with SNMP enabled**, with no workarounds except patching. Cisco urged immediate upgrades, though temporary mitigation includes **restricting SNMP access to trusted users**. The flaw was discovered after **real-world exploitation**, highlighting critical risks to network infrastructure. Additionally, Cisco patched **13 other vulnerabilities**, including two with public proof-of-concept exploits: a **reflected XSS (CVE-2025-20240)** enabling cookie theft and a **DoS flaw (CVE-2025-20149)** allowing device reloads by local attackers. Prior incidents, such as the **May 2025 IOS XE flaw** (hard-coded JWT exploitation), underscore recurring risks of **unauthenticated remote takeovers** in Cisco’s ecosystem.
Cisco
Vulnerability
Rankiteo Explanation
Attack threatening the economy of a geographical region
Description: Cisco has released security patches for multiple vulnerabilities in its Small Business RV Series router platform. This vulnerability could allow any remote attacker to gain complete control over the device without authentication. The attacker could execute arbitrary code, elevate privileges, run commands, bypass authentication protections, and retrieve and execute unsigned software if exploits the flaw.
Cisco
Vulnerability
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Over **48,800 internet-exposed Cisco Adaptive Security Appliance (ASA) and Firewall Threat Defense (FTD) devices** remain vulnerable to two critical flaws (**CVE-2025-20333** and **CVE-2025-20362**), enabling **remote, unauthenticated arbitrary code execution** and unauthorized access to VPN endpoints. Exploitation began **before patches were available**, with threat actors deploying **shellcode loaders (Line Viper)** and **GRUB bootkits (RayInitiator)**. The U.S. **CISA issued an emergency directive**, mandating federal agencies to patch or disconnect affected devices within **24 hours**, while the **U.K.’s NCSC** confirmed active attacks. Despite warnings since **late August**, most exposed devices—primarily in the **U.S., U.K., Japan, and Germany**—remain unpatched, risking **full system compromise, lateral movement, and data exfiltration**. The lack of workarounds exacerbates the threat, leaving organizations vulnerable to **persistent access, malware deployment, and potential supply-chain attacks** if breached devices are used to pivot into corporate networks.
Cisco
Vulnerability
Rankiteo Explanation
Attack threatening the organization’s existence
Description: A severe vulnerability in Cisco's networking equipment, identified as CVE-2018-0171, has been exploited by attackers, notably by the APT group Salt Typhoon. Despite a patch released in 2018, over 1,200 devices remain unpatched, providing an attack surface for unauthorized remote code execution and configuration theft. The attack chiefly involves using the Smart Install feature to extract sensitive data from networking devices, exacerbating the risk of further infiltrations and potentially catastrophic network breaches. This enduring security oversight, which notably affected telecommunications providers, exemplifies the danger legacy systems pose to the current technology infrastructure.
Cisco
Vulnerability
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: A critical vulnerability in Cisco Unified Communications Manager (Unified CM) systems allows remote attackers to gain root-level access. The flaw, CVE-2025-20309, stems from hardcoded SSH credentials that cannot be modified. Affected are Engineering Special releases 15.0.1.13010-1 through 15.0.1.13017-1. Attackers can exploit this to execute arbitrary commands without authentication, posing a severe risk to organizations with internet-facing Unified CM deployments. Immediate patching or system updates are recommended.
Cisco
Vulnerability
Rankiteo Explanation
Attack threatening the organization’s existence
Description: A significant vulnerability in Cisco’s Integrated Management Controller (IMC) allows malicious actors to gain elevated privileges and access internal services without proper authorization. This vulnerability, classified as a privilege escalation flaw, exploits weaknesses in the authentication and authorization mechanisms within the management controller’s web interface. Attackers can leverage improper input validation and insufficient access controls to bypass security restrictions and execute commands with administrative privileges. The exploitation can have far-reaching consequences, enabling attackers to access the Baseboard Management Controller (BMC) functionalities, modify BIOS settings, and potentially install persistent firmware-level malware.
Cisco
Vulnerability
Rankiteo Explanation
Attack threatening the organization's existence
Description: Cisco has patched a critical flaw in its IOS XE Software for Wireless LAN Controllers. The vulnerability, due to hardcoded tokens, allows threat actors to upload files, perform path traversal, and execute arbitrary commands with root privileges. The flaw is tracked as CVE-2025-20188 and has a maximum security score of 10/10. Although there is no evidence of abuse in the wild yet, users should patch immediately. Vulnerable devices include Catalyst 9800-CL Wireless Controllers for Cloud and other Catalyst 9800 series controllers.
Cisco
Vulnerability
Rankiteo Explanation
Attack threatening the organization's existence
Description: A critical security vulnerability in Cisco IOS XE Wireless Controller Software has been identified, allowing attackers to achieve remote code execution with root privileges. The flaw stems from a hard-coded JSON Web Token (JWT) present in the Out-of-Band Access Point (AP) Image Download feature. This vulnerability affects multiple enterprise-grade wireless controller products, including Catalyst 9800-CL Wireless Controllers for Cloud, Catalyst 9800 Embedded Wireless Controllers, and Catalyst 9800 Series Wireless Controllers. The vulnerability, tracked as CVE-2025-20188, has been assigned the maximum CVSS score of 10.0, highlighting its severe impact on affected systems.
Cisco Systems
Vulnerability
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Cisco Systems has identified multiple remote code execution vulnerabilities in its Identity Services Engine (ISE) that are being actively exploited. These vulnerabilities allow unauthenticated remote attackers to execute arbitrary commands with root privileges on affected systems. The flaws, assigned CVE numbers CVE-2025-20281, CVE-2025-20282, and CVE-2025-20337, affect Cisco ISE and ISE Passive Identity Connector (ISE-PIC) deployments. The company has released patches and emphasized the urgency of applying them immediately.
Cisco
Vulnerability
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: A critical vulnerability (CVE-2025-20337) in Cisco's Identity Services Engine (ISE) allows an unauthenticated attacker to store malicious files, execute arbitrary code, or gain root privileges on vulnerable devices. The vulnerability is due to insufficient user-supplied input validation checks and has a maximum severity rating of 10 out of 10. It affects Cisco ISE and ISE-PIC releases 3.3 and 3.4. The vulnerability was discovered by Kentaro Kawane from GMO Cybersecurity by Ierae and reported to Trend Micro's Zero Day Initiative (ZDI). System administrators are advised to take immediate action to mitigate the risks by upgrading to the specified patches.
Cisco
Vulnerability
Rankiteo Explanation
Attack threatening the organization’s existence
Description: A significant security breach due to a critical vulnerability CVE-2024-20439 in the Cisco Smart Licensing Utility has been actively exploited, allowing attackers to gain administrative access via hardcoded credentials. This flaw exposes organizations to potential data leaks and unauthorized control over affected systems, leading to operational disruptions, reputational damage, and compromising sensitive information. The vulnerability, coupled with other exploits like CVE-2024-20440, presents a considerable risk, as it simplifies the attackers' process to compromise systems and extract sensitive data.
Cisco
Vulnerability
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Cisco's Smart Licensing Utility (CSLU) was targeted by attackers exploiting a vulnerability that allowed for an undocumented administrative account to be accessed remotely. This vulnerability, known as CVE-2024-20439, alongside another flaw, CVE-2024-20440, which enabled unauthorized access to log files, could have severe ramifications if exploited. The impact and intent of these attacks are not yet fully understood, but they could potentially lead to unauthorized access to Cisco's products, leading to informational leaks or full system control. This exposure might result in tarnishing Cisco's reputation and financial losses, further impacting customers who rely on Cisco's network solutions.
Cisco
Vulnerability
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Cisco disclosed **CVE-2025-20265**, a **critical (CVSS 10.0) remote code execution (RCE) vulnerability** in its **Secure Firewall Management Center (FMC) Software**, affecting versions **7.0.7 and 7.7.0** when **RADIUS authentication** is enabled. The flaw stems from **improper input validation** during RADIUS credential processing, allowing **unauthenticated attackers** to inject and execute **arbitrary shell commands with high-level privileges** remotely. No authentication or user interaction is required, making it highly exploitable.The vulnerability poses a **severe risk** as it enables full system compromise, potentially leading to **lateral movement, data exfiltration, or complete takeover of firewall management infrastructure**. While no **public exploitation** has been reported yet, the lack of workarounds (beyond disabling RADIUS) and the **critical severity** demand **immediate patching**. Cisco has released fixes but warns that mitigation requires **disabling RADIUS**, which may disrupt operational workflows.The flaw was discovered internally, underscoring the **proactive threat** of unpatched enterprise firewall systems. Organizations failing to patch risk **catastrophic breaches**, including **unauthorized access to sensitive networks, credential theft, or downstream attacks on connected systems**.
Cisco
Vulnerability
Rankiteo Explanation
Attack threatening the organization's existence
Description: A security researcher has published a blog post demonstrating a complete exploit chain for CVE-2025-20281, a critical unauthenticated remote code execution vulnerability in Cisco Identity Services Engine (ISE). This vulnerability allows unauthenticated, remote attackers to upload arbitrary files to the target system and execute them with root privileges. The issue stems from unsafe deserialization and command injection in the enableStrongSwanTunnel() method. Although hotfixes were made available, Cisco urged users to update to 3.3 Patch 7 and 3.4 Patch 2 to address both vulnerabilities. On July 22, 2025, Cisco marked both CVE-2025-20281 and CVE-2025-20337 as actively exploited in attacks, urging admins to apply the security updates as soon as possible.
Cisco
Vulnerability
Rankiteo Explanation
Attack threatening the organization’s existence
Description: In April 2024, the China-linked APT group Velvet Ant exploited zero-day vulnerability CVE-2024-20399 in Cisco switches to deploy custom malware, gaining control over the network devices. Attackers with valid administrator credentials executed commands as root, bypassing security measures and installing the 'VELVETSHELL' malware for persistent access and espionage. The malware granted capabilities for command execution, file management, and creating traffic tunnels, compromising the integrity of Cisco's network infrastructures and potentially leading to data exfiltration.
Splunk
Vulnerability
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Splunk has suffered a security incident due to two separate high-severity vulnerabilities. The first vulnerability enables RCE, allowing low-privileged users to execute arbitrary code through malicious file uploads, affecting Splunk Enterprise and Splunk Cloud Platform before certain versions. The second vulnerability affects the Splunk Secure Gateway app, where users can search with higher-privileged permissions, leading to potential unauthorized disclosure of sensitive information. Both issues have been patched, with suggested updates provided to Splunk users to remediate the risk. The security flaws highlight the critical importance of maintaining updated systems and monitoring access control within corporate environments to prevent data breaches and maintain operational integrity.
Cisco Company Scoring based on AI Models
Cyber Incidents Likelihood 3 - 6 - 9 months
A.I Risk Score Likelihood 3 - 6 - 9 months
Underwriter Stats for Cisco
Incidents vs Software Development Industry Average (This Year)
Cisco has 3309.09% more incidents than the average of same-industry companies with at least one recorded incident.
Incidents vs All-Companies Average (This Year)
Cisco has 2207.69% more incidents than the average of all companies with at least one recorded incident.
Incident Types Cisco vs Software Development Industry Avg (This Year)
Cisco reported 15 incidents this year: 2 cyber attacks, 1 ransomware, 12 vulnerabilities, 0 data breaches, compared to industry peers with at least 1 incident.
Incident History — Cisco (X = Date, Y = Severity)
Cisco cyber incidents detection timeline including parent company and subsidiaries
Cisco Company Subsidiaries
Cisco is the worldwide technology leader that is revolutionizing the way organizations connect and protect in the AI era. For more than 40 years, Cisco has securely connected the world. With its industry leading AI-powered solutions and services, Cisco enables its customers, partners and communities to unlock innovation, enhance productivity and strengthen digital resilience. With purpose at its core, Cisco remains committed to creating a more connected and inclusive future for all.
Loading...
Cisco Similar Companies
PhonePe Group is India’s leading fintech company, proudly recognized as India’s #1 Trusted Digital Payments* Brand for three consecutive years. Our flagship product, the PhonePe app was launched in August 2016, has rapidly become the preferred consumer payments app in India. In just eight years, Pho
The Bosch Group is a leading global supplier of technology and services. It employs roughly 417,900 associates worldwide (as of December 31, 2024). According to preliminary figures, the company generated sales of 90.5 billion euros in 2024. Its operations are divided into four business sectors: Mobi
OpenText
OpenText is a leading Cloud and AI company that provides organizations around the world with a comprehensive suite of Business AI, Business Clouds, and Business Technology. We help organizations grow, innovate, become more efficient and effective, and do so in a trusted and secure way—through Inform
Meituan
Adhering to the ‘Retail + Technology’ strategy, Meituan commits to its mission that 'We help people eat better, live better'. Since its establishment in March 2010, Meituan has advanced the digital upgrading of services and goods retail on both supply and demand sides. Together with our partners we
Sage
At Sage, we knock down barriers with information, insights, and tools to help your business flow. We provide businesses with software and services that are simple and easy to use, as we work with you to give you that feeling of confidence. Customers trust our Payroll, HR, and Finance software to m
Amazon Fulfillment Technologies & Robotics
On the Fulfillment Technologies & Robotics Team, we build dynamic partnerships between people and intelligent machines. This intricate collaboration helps Amazon fulfill orders with unmatched accuracy. Since we began working with robotics, we've added over a million new jobs worldwide. Working in s
Meta
Meta's mission is to build the future of human connection and the technology that makes it possible. Our technologies help people connect, find communities, and grow businesses. When Facebook launched in 2004, it changed the way people connect. Apps like Messenger, Instagram and WhatsApp further e
Adobe
Adobe is the global leader in digital media and digital marketing solutions. Our creative, marketing and document solutions empower everyone – from emerging artists to global brands – to bring digital creations to life and deliver immersive, compelling experiences to the right person at the right mo
Just Eat Takeaway.com
Just Eat Takeaway.com is a leading global online delivery marketplace, connecting consumers and restaurants through our platform in 19 countries. Like a dinner table, working at JET brings our office employees and couriers together. From coding to customer service to couriers, JET is a
.png)
Cisco CyberSecurity News
November 20, 2025 01:52 PM
Splunk’s Impact in Cybersecurity Gains Repeated Analyst Recognition
Splunk Recognized as a Leader in SIEM and Security Analytics. SAN FRANCISCO, Nov. 20, 2025 /PRNewswire/ — Cisco today announced Splunk's continued position...
November 20, 2025 10:00 AM
With the Rise of AI, Cisco Sounds an Urgent Alarm About the Risks of Aging Tech
Generative AI is making it even easier for attackers to exploit old and often forgotten network equipment. Replacing it takes investment,...
November 19, 2025 08:45 PM
Network security key to AI security: Cisco
Peter Bailey, SVP and GM of Cisco's Security business and Juan Huat Koo, Director, Cybersecurity, Cisco ASEAN, explain why organizations...
November 17, 2025 11:00 AM
Cybersecurity News: Windows 10 update failure, autonomous AI cyberattack, Feds fumble Cisco patches
Microsoft warns of Windows 10 update failure, first large-scale autonomous AI cyberattack, Feds fumbled Cisco patches requirements,...
November 16, 2025 08:07 PM
New cybersecurity program to train Mississippians in Vicksburg
Rust College, MCITy, and Cisco Systems have launched a free cybersecurity training program in Vicksburg, offering stipends and...
November 13, 2025 02:04 PM
CISA urges immediate patching of Cisco ASA and Firepower devices due to active zero-day exploits
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has identified ongoing cyber threats targeting Cisco Adaptive Security...
November 12, 2025 09:35 PM
Federal agencies not fully patching vulnerable Cisco devices amid ‘active exploitation,’ CISA warns
Federal civilian agencies are not patching vulnerable Cisco devices sufficiently to protect themselves from an active hacking campaign,...
November 12, 2025 04:34 PM
Sophisticated threat actor targeting zero-day flaws in Cisco ISE and Citrix
An advanced persistent threat actor has been targeting zero-day vulnerabilities in Cisco Identity Service Engine as well as Citrix,...
November 10, 2025 08:00 AM
Cisco detects new attack variant targeting vulnerable firewalls
Cisco is warning about a new kind of cyberattack exploiting serious vulnerabilities in its firewalls. On Nov. 5, “Cisco became aware of a...
Frequently Asked Questions
Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
Cisco CyberSecurity History Information
Official Website of Cisco
The official website of Cisco is http://www.cisco.com.
Cisco’s AI-Generated Cybersecurity Score
According to Rankiteo, Cisco’s AI-generated cybersecurity score is 569, reflecting their Very Poor security posture.
How many security badges does Cisco’ have ?
According to Rankiteo, Cisco currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
Does Cisco have SOC 2 Type 1 certification ?
According to Rankiteo, Cisco is not certified under SOC 2 Type 1.
Does Cisco have SOC 2 Type 2 certification ?
According to Rankiteo, Cisco does not hold a SOC 2 Type 2 certification.
Does Cisco comply with GDPR ?
According to Rankiteo, Cisco is not listed as GDPR compliant.
Does Cisco have PCI DSS certification ?
According to Rankiteo, Cisco does not currently maintain PCI DSS compliance.
Does Cisco comply with HIPAA ?
According to Rankiteo, Cisco is not compliant with HIPAA regulations.
Does Cisco have ISO 27001 certification ?
According to Rankiteo,Cisco is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
Industry Classification of Cisco
Cisco operates primarily in the Software Development industry.
Number of Employees at Cisco
Cisco employs approximately 94,948 people worldwide.
Subsidiaries Owned by Cisco
Cisco presently has no subsidiaries across any sectors.
Cisco’s LinkedIn Followers
Cisco’s official LinkedIn profile has approximately 6,981,104 followers.
NAICS Classification of Cisco
Cisco is classified under the NAICS code 5112, which corresponds to Software Publishers.
Cisco’s Presence on Crunchbase
No, Cisco does not have a profile on Crunchbase.
Cisco’s Presence on LinkedIn
Yes, Cisco maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/cisco.
Cybersecurity Incidents Involving Cisco
As of November 27, 2025, Rankiteo reports that Cisco has experienced 30 cybersecurity incidents.
Number of Peer and Competitor Companies
Cisco has an estimated 26,564 peer or competitor companies worldwide.
What types of cybersecurity incidents have occurred at Cisco ?
Incident Types: The types of cybersecurity incidents that have occurred include Cyber Attack, Vulnerability, Ransomware, Data Leak and Breach.
What was the total financial impact of these incidents on Cisco ?
Total Financial Loss: The total financial loss from these incidents is estimated to be $13.07 million.
How does Cisco detect and respond to cybersecurity incidents ?
Detection and Response: The company detects and responds to cybersecurity incidents through an containment measures with took action to contain and eradicate the bad actors, and remediation measures with patches provided to users, remediation measures with suggested updates to remediate risk, and remediation measures with patching, and containment measures with disable the out-of-band ap image download feature, and remediation measures with software updates and patches, and containment measures with network segmentation, containment measures with multi-factor authentication (mfa), containment measures with disable unnecessary services, containment measures with implement strict firewall rules, containment measures with regular auditing of administrative accounts, and remediation measures with update to the latest firmware versions, and network segmentation with isolate management interfaces from production networks, and enhanced monitoring with monitor for suspicious activities in siem systems, and containment measures with apply patch ciscocm.cscwp27755_d0247-1.cop.sha512, containment measures with upgrade to 15su3 release, and remediation measures with monitor system logs for unauthorized root access, remediation measures with examine /var/log/active/syslog/secure file for indicators of compromise, and enhanced monitoring with monitor system logs for unauthorized root access, and remediation measures with upgrade to ise 3.3 patch 7 or ise 3.4 patch 2, and containment measures with immediate patching, and remediation measures with apply patches and enhanced fixed releases, and communication strategy with public advisory and urgent calls for patching, and containment measures with apply security updates, and remediation measures with update to 3.3 patch 7 and 3.4 patch 2, and and containment measures with disable radius authentication (switch to ldap/saml/local accounts), and remediation measures with apply free software updates provided by cisco, and communication strategy with public advisory via cisco’s august 2025 semiannual security advisory bundled publication, communication strategy with urgent recommendation for immediate patching, and containment measures with urgent patching advisory issued by cisco, and remediation measures with apply software updates to affected fmc versions, remediation measures with review radius authentication configurations, and communication strategy with public security advisory released by cisco, and enhanced monitoring with recommended: monitor for unauthorized access attempts targeting fmc interfaces, and and containment measures with limiting snmp access to trusted users (temporary mitigation), and remediation measures with applying security patches for cve-2025-20352, cve-2025-20240, and cve-2025-20149, and communication strategy with public advisory via cisco psirt, communication strategy with recommendation for immediate patching, and and third party assistance with u.k. national cyber security centre (ncsc), third party assistance with canadian centre for cyber security, and containment measures with cisco patches for cve-2025-20362, cve-2025-20333, cve-2025-20363, containment measures with urgent advisories for updates, containment measures with disabling vpn web services on vulnerable devices, and remediation measures with firmware analysis to detect rayinitiator/line viper, remediation measures with replacement of end-of-support (eos) devices, remediation measures with implementation of secure boot/trust anchor on newer models, and communication strategy with public advisories by ncsc (2025-09-25), communication strategy with cisco security bulletins, communication strategy with canadian centre for cyber security alerts, and enhanced monitoring with recommended for asa/ftd devices, and and third party assistance with five eyes intelligence alliance, third party assistance with cisco internal teams, and containment measures with urgent patching of cisco asa vulnerabilities, containment measures with emergency directives (e.g., u.s. cisa's midnight deadline for federal agencies), and communication strategy with public warnings by cse (canada), cisa (u.s.), ncsc (uk), communication strategy with media statements (e.g., cbc news), communication strategy with collaboration with five eyes alliance, and enhanced monitoring with recommended (implied by urgency of patching and detection evasion concerns), and and third party assistance with cisco cybersecurity experts, and containment measures with cisa directive to identify affected devices, containment measures with data collection and threat assessment using cisa tools, and remediation measures with patching vulnerabilities (cve-2024-20353, cve-2024-20359), remediation measures with addressing cyber vulnerabilities in cisco devices, and communication strategy with public disclosure via bloomberg, communication strategy with cisa advisories, and enhanced monitoring with use of cisa cybersecurity tools for threat assessment, and incident response plan activated with cisco security advisory (2024-09-25), incident response plan activated with cisa emergency directive (24-hour patching mandate), incident response plan activated with ncsc (uk) threat report, and third party assistance with the shadowserver foundation (threat monitoring), third party assistance with greynoise (early warning scans), and containment measures with restrict vpn web interface exposure, containment measures with disconnect end-of-support (eos) asa devices, containment measures with increase logging/monitoring for suspicious vpn logins, and remediation measures with apply cisco patches for cve-2025-20333 and cve-2025-20362, remediation measures with follow cisco hardening guidelines, and communication strategy with cisco security advisories [1, 2], communication strategy with cisa emergency directive, communication strategy with ncsc threat report, and enhanced monitoring with monitor for crafted http requests, enhanced monitoring with track suspicious vpn logins, and third party assistance with fbi investigation, third party assistance with symantec (threat intelligence), third party assistance with kaspersky (decryption tool), and and remediation measures with kaspersky released free decrypter (2022), and and third party assistance with fbi, third party assistance with international law enforcement (italy), and and and containment measures with immediate software upgrade to patched versions (e.g., 2.3.7.10-va), and remediation measures with no workarounds; mandatory patching, and communication strategy with public security advisory, communication strategy with direct customer notifications via tac..
Incident Details
Can you provide details on each incident ?
Title: Cisco Small Business RV Series Router Vulnerabilities
Description: Cisco has released security patches for multiple vulnerabilities in its Small Business RV Series router platform. This vulnerability could allow any remote attacker to gain complete control over the device without authentication. The attacker could execute arbitrary code, elevate privileges, run commands, bypass authentication protections, and retrieve and execute unsigned software if exploits the flaw.
Type: Vulnerability Exploitation
Attack Vector: RemoteUnauthenticated
Vulnerability Exploited: Multiple vulnerabilities in Cisco Small Business RV Series routers
Title: Cisco Hacked by Yanluowang Ransomware Gang
Description: Cisco experienced a ransomware attack by the Yanluowang gang, resulting in the alleged theft of 2.8GB of data.
Type: Ransomware
Threat Actor: Yanluowang ransomware gang
Motivation: Data theft and ransom
Title: CISCO Cyber Incident
Description: CISCO experienced a cyber incident where threat actors gained access to a directory of Drive C and posted it on their leak site. The incident involved credential compromise and sophisticated voice phishing attacks.
Type: Data Breach
Attack Vector: Voice PhishingCredential Compromise
Vulnerability Exploited: MFA Push Notification Acceptance
Threat Actor: Unknown
Motivation: Data Theft
Title: Cisco Data Leak by Yanluowang Ransomware Gang
Description: Cisco was targeted in a data leak by the Yanluowang ransomware gang in September 2022. The gang leaked data stolen from the company network during a cyberattack in May. The stolen data included non-sensitive files from the employee’s Box folder and thousands of files amounting to 55GB, including classified documents, technical schematics, and source code.
Date Publicly Disclosed: 2022-09
Type: Data Leak
Threat Actor: Yanluowang Ransomware Gang
Title: Unauthorized Access to Cisco Cloud Infrastructure
Description: A former Cisco employee accessed the company's cloud infrastructure in 2018, five months after resigning, to deploy code that led to the shutdown of more than 16,000 WebEx Teams accounts and the deletion of 456 virtual machines.
Date Detected: 2018-09-24
Type: Unauthorized Access
Attack Vector: Unauthorized access to cloud infrastructure
Threat Actor: Sudhish Kasaba Ramesh
Motivation: Malicious intent
Title: Cisco Professional Careers Portal Data Leak
Description: Cisco has addressed a security flaw that allowed personal data to leak from the company's Professional Careers portal. The data leak occurred due to an erroneous security configuration on a third-party site following system repair.
Type: Data Leak
Attack Vector: Erroneous Security Configuration
Vulnerability Exploited: Security Misconfiguration
Title: Ransomware Attack on Cisco
Description: Cisco, a leading technology company known for its cybersecurity and incident response services through Cisco Talos, experienced a significant ransomware attack on May 24, 2022. The ransomware group identified as Yanluowang was able to gain access to an employee’s credentials via a compromised personal Google account. This breach allowed the attackers to infiltrate Cisco’s systems, representing a severe security incident for the company. Although Cisco is renowned for its robust security measures, the attack highlights the sophisticated techniques employed by ransomware gangs to target and compromise even the most secure entities. The company embarked on a comprehensive response to mitigate the impact of the attack, demonstrating the importance of preparedness and swift action in the face of ransomware threats. The incident underscores the ongoing challenges organizations face in protecting against the evolving landscape of cyber threats and the necessity for continuous enhancement of cybersecurity protocols.
Date Detected: 2022-05-24
Type: Ransomware Attack
Attack Vector: Compromised personal Google account
Threat Actor: Yanluowang
Title: Velvet Ant APT Group Exploits Cisco Switches
Description: In April 2024, the China-linked APT group Velvet Ant exploited zero-day vulnerability CVE-2024-20399 in Cisco switches to deploy custom malware, gaining control over the network devices. Attackers with valid administrator credentials executed commands as root, bypassing security measures and installing the 'VELVETSHELL' malware for persistent access and espionage. The malware granted capabilities for command execution, file management, and creating traffic tunnels, compromising the integrity of Cisco's network infrastructures and potentially leading to data exfiltration.
Date Detected: April 2024
Type: Advanced Persistent Threat (APT)
Attack Vector: Zero-day vulnerability exploitation
Vulnerability Exploited: CVE-2024-20399
Threat Actor: Velvet Ant
Motivation: Espionage
Title: Cisco Smart Licensing Utility Vulnerability Exploitation
Description: Cisco's Smart Licensing Utility (CSLU) was targeted by attackers exploiting a vulnerability that allowed for an undocumented administrative account to be accessed remotely. This vulnerability, known as CVE-2024-20439, alongside another flaw, CVE-2024-20440, which enabled unauthorized access to log files, could have severe ramifications if exploited. The impact and intent of these attacks are not yet fully understood, but they could potentially lead to unauthorized access to Cisco's products, leading to informational leaks or full system control. This exposure might result in tarnishing Cisco's reputation and financial losses, further impacting customers who rely on Cisco's network solutions.
Type: Vulnerability Exploitation
Attack Vector: Remote Access
Vulnerability Exploited: CVE-2024-20439CVE-2024-20440
Title: Splunk Security Incident
Description: Splunk has suffered a security incident due to two separate high-severity vulnerabilities. The first vulnerability enables RCE, allowing low-privileged users to execute arbitrary code through malicious file uploads, affecting Splunk Enterprise and Splunk Cloud Platform before certain versions. The second vulnerability affects the Splunk Secure Gateway app, where users can search with higher-privileged permissions, leading to potential unauthorized disclosure of sensitive information. Both issues have been patched, with suggested updates provided to Splunk users to remediate the risk. The security flaws highlight the critical importance of maintaining updated systems and monitoring access control within corporate environments to prevent data breaches and maintain operational integrity.
Type: Security Vulnerabilities
Attack Vector: Malicious File UploadsPrivilege Escalation
Vulnerability Exploited: Remote Code Execution (RCE)Unauthorized Disclosure of Sensitive Information
Title: Cisco Smart Licensing Utility Vulnerability Exploit
Description: A significant security breach due to a critical vulnerability CVE-2024-20439 in the Cisco Smart Licensing Utility has been actively exploited, allowing attackers to gain administrative access via hardcoded credentials. This flaw exposes organizations to potential data leaks and unauthorized control over affected systems, leading to operational disruptions, reputational damage, and compromising sensitive information. The vulnerability, coupled with other exploits like CVE-2024-20440, presents a considerable risk, as it simplifies the attackers' process to compromise systems and extract sensitive data.
Type: Security Breach
Attack Vector: Hardcoded Credentials
Vulnerability Exploited: CVE-2024-20439CVE-2024-20440
Motivation: Unauthorized Access, Data Leak
Title: CVE-2018-0171 Exploitation in Cisco Networking Equipment
Description: A severe vulnerability in Cisco's networking equipment, identified as CVE-2018-0171, has been exploited by attackers, notably by the APT group Salt Typhoon. Despite a patch released in 2018, over 1,200 devices remain unpatched, providing an attack surface for unauthorized remote code execution and configuration theft. The attack chiefly involves using the Smart Install feature to extract sensitive data from networking devices, exacerbating the risk of further infiltrations and potentially catastrophic network breaches. This enduring security oversight, which notably affected telecommunications providers, exemplifies the danger legacy systems pose to the current technology infrastructure.
Type: Vulnerability Exploitation
Attack Vector: Remote Code Execution, Configuration Theft
Vulnerability Exploited: CVE-2018-0171
Threat Actor: Salt Typhoon
Motivation: Data Theft, Unauthorized Access
Title: Cisco IOS XE Software for Wireless LAN Controllers Vulnerability
Description: Cisco has patched a critical flaw in its IOS XE Software for Wireless LAN Controllers. The vulnerability, due to hardcoded tokens, allows threat actors to upload files, perform path traversal, and execute arbitrary commands with root privileges. The flaw is tracked as CVE-2025-20188 and has a maximum security score of 10/10. Although there is no evidence of abuse in the wild yet, users should patch immediately. Vulnerable devices include Catalyst 9800-CL Wireless Controllers for Cloud and other Catalyst 9800 series controllers.
Type: Vulnerability Exploitation
Attack Vector: File UploadPath TraversalArbitrary Command Execution
Vulnerability Exploited: CVE-2025-20188
Title: Cisco IOS XE Wireless Controller Software Vulnerability
Description: A critical security vulnerability in Cisco IOS XE Wireless Controller Software allows unauthenticated remote attackers to achieve remote code execution with root privileges.
Date Detected: 2025-05-07
Date Publicly Disclosed: 2025-05-07
Type: Software Vulnerability
Attack Vector: Remote Code Execution
Vulnerability Exploited: CVE-2025-20188
Motivation: System Compromise
Title: Cisco IMC Privilege Escalation Flaw
Description: A significant vulnerability in Cisco’s Integrated Management Controller (IMC) that allows malicious actors to gain elevated privileges and access internal services without proper authorization.
Type: Privilege Escalation
Attack Vector: Improper input validationInsufficient access controls
Vulnerability Exploited: CVE-2025-20261
Motivation: Unauthorized access to critical systems and sensitive data
Title: CVE-2025-20309: Critical Root Access Vulnerability in Cisco Unified Communications Manager
Description: A severe vulnerability in Cisco Unified Communications Manager (Unified CM) systems could allow remote attackers to gain root-level access to affected devices. The vulnerability, designated CVE-2025-20309 with a maximum CVSS score of 10.0, affects Engineering Special releases and stems from hardcoded SSH credentials that cannot be modified or removed by administrators.
Type: Remote Access Vulnerability
Attack Vector: Network
Vulnerability Exploited: CVE-2025-20309
Motivation: Unauthorized access and control
Title: Cisco ISE Critical Vulnerability (CVE-2025-20337)
Description: A critical vulnerability (CVE-2025-20337) in Cisco's Identity Services Engine (ISE) could be exploited to let an unauthenticated attacker store malicious files, execute arbitrary code, or gain root privileges on vulnerable devices.
Type: Vulnerability
Attack Vector: Remote
Vulnerability Exploited: CVE-2025-20337
Title: Cisco ISE Critical Vulnerabilities Actively Exploited
Description: Cisco Systems has issued a critical security advisory warning of multiple remote code execution vulnerabilities in its Identity Services Engine (ISE) that are being actively exploited by attackers in the wild.
Date Detected: 2025-07-01
Date Publicly Disclosed: 2025-07-01
Type: Vulnerability Exploitation
Attack Vector: Remote Code Execution
Vulnerability Exploited: CVE-2025-20281CVE-2025-20282CVE-2025-20337
Motivation: Unauthorized access and control
Title: Cisco Systems Data Breach
Description: A data breach occurred at Cisco Systems, Inc. due to a security setting error on the Cisco Professional Careers mobile website, potentially exposing job application-related personal information.
Date Detected: 2016-08-18
Date Publicly Disclosed: 2016-10-25
Type: Data Breach
Attack Vector: Security Setting Error
Vulnerability Exploited: Security Setting Error
Title: Critical Vulnerabilities in Cisco Identity Services Engine (ISE)
Description: Security researcher Bobby Gould has published a blog post demonstrating a complete exploit chain for CVE-2025-20281, an unauthenticated remote code execution vulnerability in Cisco Identity Services Engine (ISE). The critical vulnerability was first disclosed on June 25, 2025, with Cisco warning that it impacts ISE and ISE-PIC versions 3.3 and 3.4, allowing unauthenticated, remote attackers to upload arbitrary files to the target system and execute them with root privileges. The issue stems from unsafe deserialization and command injection in the enableStrongSwanTunnel() method. Three weeks later, the vendor added one more flaw to the same bulletin, CVE-2025-20337, which relates to the same flaw but is now broken down into two parts, CVE-2025-20281 (command injection) and CVE-2025-20337 (deserialization). Although hotfixes were previously made available, Cisco urged users to update to 3.3 Patch 7 and 3.4 Patch 2 to address both vulnerabilities. On July 22, 2025, Cisco marked both CVE-2025-20281 and CVE-2025-20337 as actively exploited in attacks, urging admins to apply the security updates as soon as possible.
Date Detected: 2025-06-25
Date Publicly Disclosed: 2025-06-25
Date Resolved: 2025-07-22
Type: Remote Code Execution
Attack Vector: Unauthenticated remote attack
Vulnerability Exploited: CVE-2025-20281CVE-2025-20337
Title: Critical Remote Code Execution Vulnerability in Cisco Secure Firewall Management Center (FMC) Software (CVE-2025-20265)
Description: Cisco has disclosed a critical security vulnerability (CVE-2025-20265, CVSS 10.0) in its Secure Firewall Management Center (FMC) Software, allowing unauthenticated attackers to execute arbitrary shell commands with high-level privileges remotely. The flaw resides in the RADIUS subsystem during the authentication phase, where improper input validation enables command injection via specially crafted credentials. No authentication is required, and exploitation is possible over the network. Affected versions include Cisco Secure FMC Software 7.0.7 and 7.7.0 when RADIUS authentication is enabled. No workarounds exist; patching or disabling RADIUS authentication (switching to LDAP/SAML/local accounts) are the only mitigations. Cisco has released free updates and urges immediate action. No public exploitation has been reported.
Date Publicly Disclosed: August 2025
Type: Vulnerability Disclosure
Attack Vector: NetworkRADIUS Authentication ExploitationUnauthenticated
Vulnerability Exploited: Cve Id: CVE-2025-20265, Cvss Score: 10.0, Component: RADIUS Subsystem (Authentication Phase), Root Cause: Insufficient Input Validation, 7.0.77.7.0RADIUS authentication enabled for web/SSH management
Title: Cisco Secure Firewall Management Center (FMC) RADIUS Authentication Bypass Vulnerability
Description: Admins using Cisco Systems Secure Firewall Management Center (FMC) Software for network login authentication are being warned to quickly patch a major vulnerability (CVE not explicitly mentioned) that could allow a remote attacker to breach security. The flaw exists in deployments configured for RADIUS authentication for the web-based management interface, SSH management, or both. The vulnerability stems from improper handling of user input during the authentication phase, enabling an attacker to send crafted credentials to the RADIUS server. Successful exploitation could grant high-privilege command execution.
Type: Vulnerability Exploitation
Attack Vector: RemoteNetwork-basedCrafted Input Injection
Vulnerability Exploited: Cve Id: None, Description: Improper handling of user input during RADIUS authentication in Cisco FMC Software (affects releases 7.0.7 and 7.7.0 only)., Cvss Score: None, Severity: Critical (implied by 'major vulnerability' and high-privilege impact).
Title: Cisco IOS and IOS XE Software Zero-Day Vulnerability (CVE-2025-20352) Exploited in Wild
Description: Cisco has released security updates to address a high-severity zero-day vulnerability (CVE-2025-20352) in Cisco IOS and IOS XE Software, currently being exploited in attacks. The flaw is a stack-based buffer overflow in the SNMP subsystem, allowing authenticated remote attackers with low privileges to trigger DoS conditions or, if high-privileged, execute arbitrary code as root. Exploitation occurs via crafted SNMP packets over IPv4/IPv6. Cisco PSIRT confirmed in-the-wild exploitation after local Administrator credentials were compromised. Patches are available, but no workarounds exist beyond limiting SNMP access to trusted users as a temporary mitigation. Two additional vulnerabilities (CVE-2025-20240 and CVE-2025-20149) were also patched, with PoC exploit code available for the former.
Type: Zero-day Exploitation
Attack Vector: NetworkSNMP Protocol (IPv4/IPv6)
Title: Exploitation of Cisco Firewall Zero-Day Vulnerabilities by ArcaneDoor (UAT4356/Storm-1849) to Deploy RayInitiator and LINE VIPER Malware
Description: The U.K. National Cyber Security Centre (NCSC) revealed that threat actors (suspected China-linked hacking group UAT4356/Storm-1849, aka ArcaneDoor) exploited zero-day vulnerabilities in Cisco ASA 5500-X Series firewalls to deploy previously undocumented malware families (RayInitiator and LINE VIPER). The campaign targeted government agencies, leveraging memory corruption bugs (CVE-2025-20362, CVE-2025-20333) to bypass authentication, execute commands, and exfiltrate data. The attackers used advanced evasion techniques, including disabling logging, intercepting CLI commands, and crashing devices to hinder analysis. Persistence was achieved via ROMMON modifications on devices lacking Secure Boot/Trust Anchor. A third critical flaw (CVE-2025-20363) was patched but not exploited in the wild.
Date Detected: 2025-05
Date Publicly Disclosed: 2025-09-25
Type: Zero-day exploitation
Attack Vector: Exploitation of CVE-2025-20362 (CVSS 6.5)Exploitation of CVE-2025-20333 (CVSS 9.9)Multi-stage bootkit (RayInitiator)User-mode shellcode loader (LINE VIPER)ROMMON modification for persistenceWebVPN/HTTPS and ICMP/TCP C2 communication
Vulnerability Exploited: CVE-2025-20362 (Memory corruption in Cisco ASA Software)CVE-2025-20333 (Authentication bypass in Cisco ASA Software)Lack of Secure Boot/Trust Anchor in ASA 5500-X SeriesEnd-of-support (EoS) devices (ASA 5500-X Series)
Threat Actor: ArcaneDoorUAT4356Storm-1849Suspected China-linked state-sponsored group
Motivation: EspionageData exfiltrationPersistence in government networks
Title: Advanced Espionage Campaign Targeting Cisco ASA Devices (ArcaneDoor)
Description: Government cyber agencies worldwide are responding to a sophisticated espionage campaign targeting Cisco's adaptive security appliances (ASA), widely used for VPNs by remote workers. The threat actor, linked to the ArcaneDoor campaign, exploited vulnerabilities to implant malware, execute commands, and potentially exfiltrate data. Critical infrastructure sectors, including governments, academia, and research facilities, are urged to patch vulnerabilities immediately. The attack is described as state-sponsored and highly evasive, prompting emergency directives from the U.S. CISA and warnings from Canada's CSE and the UK's NCSC.
Date Detected: 2024-05
Date Publicly Disclosed: 2024-06-20
Type: Espionage
Attack Vector: Vulnerability Exploitation (Cisco ASA)Malware ImplantationCommand ExecutionPotential Data Exfiltration
Vulnerability Exploited: Unspecified Cisco ASA Vulnerabilities (ArcaneDoor Campaign)
Threat Actor: State-sponsored actor (high confidence; linked to ArcaneDoor campaign)
Motivation: Espionage
Title: Hackers hit the United States: Critical federal infrastructure compromised via Cisco networking equipment breach
Description: Hackers breached Cisco networking equipment belonging to several US government agencies on September 26, 2025. The attack, attributed to the ArcaneDoor hacker group, targeted critical U.S. federal cyber infrastructure, including Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. Zero-day vulnerabilities (CVE-2024-20353 and CVE-2024-20359) were exploited, enabling remote denial-of-service (DoS) attacks and privilege escalation from administrator to root access. The breach follows prior incidents in 2024 and a separate August 2025 hack of U.S. federal courts by Russian actors, where classified documents were stolen.
Date Detected: 2025-09-26
Date Publicly Disclosed: 2025-09-28
Type: Cyberattack
Attack Vector: Exploitation of Zero-Day Vulnerabilities (CVE-2024-20353, CVE-2024-20359)Remote Access
Vulnerability Exploited: CVE-2024-20353 (Infinite Loop DoS)CVE-2024-20359 (Privilege Escalation: Admin → Root)
Threat Actor: ArcaneDoor Hacker GroupRussian Hackers (for federal courts breach)
Motivation: EspionageCyber WarfareFinancial Gain (potential sale of exploit methods)
Title: Active Exploitation of Cisco ASA and FTD Vulnerabilities (CVE-2025-20333, CVE-2025-20362)
Description: Roughly 50,000 Cisco Adaptive Security Appliance (ASA) and Firewall Threat Defense (FTD) appliances exposed on the public web are vulnerable to two actively exploited vulnerabilities (CVE-2025-20333 and CVE-2025-20362). These flaws enable arbitrary code execution and unauthorized access to restricted VPN endpoints. Exploitation began before patches were available, with no workarounds existing. Over 48,800 internet-exposed instances remain unpatched as of September 29, 2024. Threat actors have deployed malware such as 'Line Viper' (shellcode loader) and 'RayInitiator' (GRUB bootkit). CISA issued an emergency directive mandating federal agencies to patch or disconnect affected devices within 24 hours.
Date Detected: 2024-08-01
Date Publicly Disclosed: 2024-09-25
Type: Vulnerability Exploitation
Attack Vector: Remote Code Execution (RCE)Unauthenticated Access to VPN EndpointsCrafted HTTP Requests
Vulnerability Exploited: CVE-2025-20333CVE-2025-20362
Motivation: Opportunistic ExploitationPotential Data TheftMalware Distribution
Title: Yanluowang Ransomware Attacks Facilitated by Initial Access Broker Aleksey Volkov
Description: A Russian national, Aleksey Olegovich Volkov (25), acted as an initial access broker for the Yanluowang ransomware gang, infiltrating networks of at least eight U.S.-based organizations (including banks, telecoms, and engineering firms) between July 2021 and November 2022. Volkov sold network access to the gang in exchange for a cut of ransom payments (totaling over $256,000 from two confirmed payouts of ~$1.5M). He also conducted DDoS attacks and threatening tactics to coerce victims. Volkov was arrested in Rome in 2023, extradited to the U.S., and agreed to a plea deal in 2025, including $9M in restitution. The Yanluowang group disbanded in late 2022 after its leak site was hacked, revealing its members were likely Russian (despite masquerading as Chinese).
Date Publicly Disclosed: 2025-10-29
Type: Ransomware
Attack Vector: Exploited Vulnerabilities (unspecified)Phishing/Social Engineering (likely)DDoS AttacksThreatening Calls to Executives
Threat Actor: Name: Aleksey Olegovich Volkov (aka 'chubaka.kor')Affiliation: ['Yanluowang Ransomware Gang', 'LockBit Ransomware Gang (alleged communication)']Nationality: RussianRole: Initial Access BrokerAliases: ['chubaka.kor', 'Alekseq Olegovi3 Volkov']Birthdate: 2000-03-20Cryptocurrency Wallets: ['Linked to Russian passport-verified account']Email: [email protected] Id: [email protected]
Motivation: Financial Gain (ransomware proceeds, access sales)
Title: Yanluowang Ransomware Attacks Facilitated by Initial Access Broker Aleksey Olegovich Volkov
Description: A Russian national, Aleksey Olegovich Volkov (aliases: 'chubaka.kor', 'nets'), acted as an initial access broker (IAB) for Yanluowang ransomware attacks targeting at least eight U.S. companies between July 2021 and November 2022. Volkov breached corporate networks, sold access to the ransomware group, and received a percentage of ransom payments totaling $1.5 million from two victims. He was linked to attacks on companies across multiple U.S. states, including a Philadelphia-based company, an engineering firm, a California company, a Michigan bank, an Illinois business, a Georgia company, an Ohio telecommunications provider, and a business in the Eastern District of Pennsylvania. Volkov was arrested in Italy in January 2024, extradited to the U.S., and faces up to 53 years in prison along with $9.1 million in restitution.
Date Publicly Disclosed: 2024-10-29
Type: ransomware
Attack Vector: credential theftnetwork intrusionsocial engineering (potential)exploitation of vulnerabilities (unspecified)
Threat Actor: Name: Aleksey Olegovich VolkovAliases: ['chubaka.kor', 'nets', '[email protected]', '[email protected]']Affiliation: ['Yanluowang ransomware group', 'potential link to LockBit ransomware gang']Nationality: RussianStatus: arrested (January 2024), extradited to U.S., pleaded guilty (October 29, 2024)
Motivation: financial gain
Title: Cisco Catalyst Center Virtual Appliance Privilege Escalation Vulnerability (CVE-2025-20341)
Description: A critical security vulnerability (CVE-2025-20341) in the Cisco Catalyst Center Virtual Appliance could enable authenticated, remote attackers with at least Observer-level privileges to escalate their access to Administrator via crafted HTTP requests due to insufficient input validation. The vulnerability affects only virtual appliances deployed on VMware ESXi, with no workarounds available. Immediate patching to fixed software versions (e.g., 2.3.7.10-VA or later) is required. No evidence of in-the-wild exploitation has been reported as of the advisory.
Type: Vulnerability
Attack Vector: NetworkAuthenticated Remote
Vulnerability Exploited: CVE-2025-20341 (Insufficient Input Validation)
What are the most common types of attacks the company has faced ?
Common Attack Types: The most common types of attacks the company has faced is Vulnerability.
How does the company identify the attack vectors used in incidents ?
Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Personal Google Account, Amazon Web Services, Compromised personal Google account, Cisco switches, Smart Install Feature, /aparchive/upload and /ap_spec_rec/upload/, Hardcoded SSH credentials, Crafted API requests, RADIUS authentication interface in FMC, Compromised local Administrator credentials, CVE-2025-20362 and CVE-2025-20333 in Cisco ASA VPN web services, Vulnerabilities in Cisco ASA devices (legacy systems targeted), Cisco ASA/FTD vulnerabilities (CVE-2024-20353, CVE-2024-20359), Exposed VPN Web InterfacesCrafted HTTP Requests Targeting CVE-2025-20333/CVE-2025-20362, Exploited Vulnerabilities (unspecified)Potential Phishing and corporate network breaches (method unspecified).
Impact of the Incidents
What was the impact of each incident ?
Incident : Vulnerability Exploitation CIS13829322
Systems Affected: Cisco Small Business RV Series routers
Incident : Ransomware CIS0217922
Data Compromised: Cisco products or services, Sensitive customer data, Sensitive employee information, Intellectual property, Supply chain operations
Incident : Data Breach CIS193201022
Data Compromised: 3,176 files, 2,875,897,023 bytes in 2111 directories
Incident : Data Leak CIS193291022
Data Compromised: Non-sensitive files, Classified documents, Technical schematics, Source code
Incident : Unauthorized Access CIS205918123
Financial Loss: $2,400,000
Systems Affected: 16,000 WebEx Teams accounts456 virtual machines
Operational Impact: Significant
Incident : Data Leak CIS1221121123
Data Compromised: Name, Password, Email address, Phone number, Security question answers, Professional profile, Educational background, Cover letter, Resume content
Systems Affected: Professional Careers portal
Incident : Advanced Persistent Threat (APT) CIS000082424
Systems Affected: Cisco switches
Incident : Vulnerability Exploitation CIS939032125
Brand Reputation Impact: Potential tarnishing of Cisco's reputation
Incident : Security Vulnerabilities SPL355032725
Systems Affected: Splunk EnterpriseSplunk Cloud PlatformSplunk Secure Gateway app
Incident : Security Breach CIS741040125
Data Compromised: Sensitive Information
Systems Affected: Cisco Smart Licensing Utility
Operational Impact: Operational Disruptions
Brand Reputation Impact: Reputational Damage
Incident : Vulnerability Exploitation CIS929041225
Data Compromised: Sensitive Data
Systems Affected: Networking Devices
Incident : Vulnerability Exploitation CIS221051225
Systems Affected: Catalyst 9800-CL Wireless Controllers for CloudCatalyst 9800 series controllers
Incident : Software Vulnerability CIS719053025
Systems Affected: Catalyst 9800-CL Wireless Controllers for CloudCatalyst 9800 Embedded Wireless Controllers for Catalyst 9300/9400/9500 Series SwitchesCatalyst 9800 Series Wireless ControllersEmbedded Wireless Controller on Catalyst APs
Incident : Privilege Escalation CIS616060625
Systems Affected: Cisco UCS C-SeriesCisco UCS S-Series
Incident : Remote Access Vulnerability CIS356070325
Systems Affected: Cisco Unified Communications ManagerCisco Unified Communications Manager Session Management Edition
Incident : Vulnerability CIS606071825
Systems Affected: Cisco ISE and ISE-PIC versions 3.4 and 3.3
Incident : Vulnerability Exploitation CIS958072325
Systems Affected: Cisco ISE and ISE-PIC deployments
Incident : Data Breach CIS747072825
Data Compromised: Names, Addresses, Emails, Phone numbers, Other sensitive data
Systems Affected: Cisco Professional Careers mobile website
Incident : Remote Code Execution CIS905072925
Systems Affected: Cisco ISE and ISE-PIC versions 3.3 and 3.4
Incident : Vulnerability Disclosure CIS751081525
Systems Affected: Cisco Secure Firewall Management Center (FMC) Software (versions 7.0.7, 7.7.0 with RADIUS enabled)
Operational Impact: Potential disruption if RADIUS authentication is disabled (requires reconfiguration to LDAP/SAML/local accounts)Emergency patching may require maintenance windows
Brand Reputation Impact: High (critical vulnerability in enterprise firewall infrastructure)
Incident : Vulnerability Exploitation CIS834081625
Systems Affected: Cisco Secure Firewall Management Center (FMC) Software (versions 7.0.7, 7.7.0)
Operational Impact: Potential unauthorized high-privilege access to firewall management systemsRisk of lateral movement within network
Brand Reputation Impact: Potential reputational damage due to unpatched critical vulnerability in security product
Incident : Zero-day Exploitation CIS2892128092425
Systems Affected: Cisco devices running vulnerable IOS/IOS XE Software with SNMP enabled
Operational Impact: Denial-of-Service (DoS) conditionsPotential full system control by high-privileged attackersCookie theft via XSS (CVE-2025-20240)
Incident : Zero-day exploitation CIS5262052092625
Data Compromised: Potential exfiltration from government agencies, Vpn credentials (via aaa bypass), Cli commands (harvested), Packet captures
Systems Affected: Cisco ASA 5500-X Series (5512-X, 5515-X, 5525-X, 5545-X, 5555-X, 5585-X)Devices running Cisco ASA Software 9.12 or 9.14 with VPN web services enabled
Downtime: ['Intentional device crashes to evade analysis', 'Delayed reboots triggered by LINE VIPER']
Operational Impact: Compromised firewall integrityBypassed authentication (AAA)Suppressed syslog messagesModified CLI commands (e.g., copy, verify)
Brand Reputation Impact: Potential loss of trust in Cisco ASA security productsGovernment agencies targeted
Identity Theft Risk: ['Potential risk if VPN credentials were exfiltrated']
Incident : Espionage CIS5802058092725
Systems Affected: Cisco Adaptive Security Appliances (ASA)VPN-enabled systems used by remote workers
Operational Impact: High (potential data exfiltration, command execution, and malware persistence in critical infrastructure sectors)
Brand Reputation Impact: Moderate to High (urgent global warnings issued by cyber agencies)
Incident : Cyberattack CIS2032020092825
Data Compromised: Classified documents (espionage, fraud, money laundering, foreign agent activities)
Systems Affected: Cisco Adaptive Security Appliance (ASA)Firepower Threat Defense (FTD) softwareHundreds of Cisco firewall devicesU.S. federal courts computer systems
Operational Impact: Disruption of federal cyber infrastructurePotential loss of sensitive government data
Brand Reputation Impact: Erosion of public trust in U.S. federal cybersecurityReputational damage to Cisco
Incident : Vulnerability Exploitation CIS0692106093025
Systems Affected: 50,000 (48,800 confirmed unpatched as of 2024-09-29)
Operational Impact: Potential Unauthorized VPN AccessMalware Infection (Line Viper, RayInitiator)Risk of Lateral Movement
Brand Reputation Impact: Potential Erosion of Trust in Cisco Security ProductsRegulatory Scrutiny
Legal Liabilities: Non-Compliance with CISA Emergency Directive for Federal AgenciesPotential Violations of Data Protection Laws
Incident : Ransomware CIS0702107111125
Financial Loss: $1.5M+ (confirmed ransom payments) + $9M (restitution agreed in plea deal)
Operational Impact: System LockoutsDDoS DisruptionsExecutive Threats
Brand Reputation Impact: High (targeted high-profile U.S. firms)Associated with extortion tactics
Legal Liabilities: Plea deal for hacking, extortion, and theft chargesDecades-long prison sentence pending
Incident : ransomware CIS2802228111125
Financial Loss: $9,167,198.19 (restitution amount)
Legal Liabilities: $9,167,198.19 (restitution) + potential fines
Identity Theft Risk: True
Incident : Vulnerability CIS4992749111425
Systems Affected: Cisco Catalyst Center Virtual Appliances on VMware ESXi (versions 2.3.7.3-VA and later, excluding 3.1+)
Operational Impact: Potential unauthorized administrative accessRisk of account creation/privilege elevation
Brand Reputation Impact: Potential reputational risk if exploited
What is the average financial loss per incident ?
Average Financial Loss: The average financial loss per incident is $435.57 thousand.
What types of data are most commonly compromised in incidents ?
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Cisco Products Or Services, Sensitive Customer Data, Sensitive Employee Information, Intellectual Property, Supply Chain Operations, , Non-Sensitive Files, Classified Documents, Technical Schematics, Source Code, , Personal Details, Professional Profile, Educational Background, Cover Letter, Resume Content, , Sensitive Information, Sensitive Data, Personal Information, , Vpn Authentication Data, Cli Command History, Network Packet Captures, Potential Government Data, , Classified Government Documents, Espionage-Related Data, Fraud/Money Laundering Records, Foreign Agent Activities, , Corporate Network Credentials, Stolen Data (Unspecified), Non-Sensitive Files (Cisco Box Folder) and .
Which entities were affected by each incident ?
Incident : Vulnerability Exploitation CIS13829322
Entity Name: Cisco
Entity Type: Organization
Industry: Technology
Incident : Unauthorized Access CIS205918123
Entity Name: Cisco
Entity Type: Company
Industry: Technology
Incident : Ransomware Attack CIS311050624
Entity Name: Cisco
Entity Type: Technology Company
Industry: Technology
Incident : Advanced Persistent Threat (APT) CIS000082424
Entity Name: Cisco
Entity Type: Organization
Industry: Technology
Incident : Vulnerability Exploitation CIS939032125
Entity Name: Cisco
Entity Type: Corporation
Industry: Technology
Incident : Security Vulnerabilities SPL355032725
Entity Name: Splunk
Entity Type: Corporation
Industry: Software
Incident : Security Breach CIS741040125
Entity Name: Cisco
Entity Type: Corporation
Industry: Technology
Incident : Vulnerability Exploitation CIS929041225
Entity Name: Cisco
Entity Type: Technology Company
Industry: Networking Equipment
Incident : Vulnerability Exploitation CIS221051225
Entity Name: Cisco
Entity Type: Technology Company
Industry: Networking
Incident : Software Vulnerability CIS719053025
Entity Name: Cisco
Entity Type: Technology Company
Industry: Networking Equipment
Size: Large Enterprise
Incident : Privilege Escalation CIS616060625
Entity Name: Cisco
Entity Type: Technology Company
Industry: Networking Hardware
Incident : Remote Access Vulnerability CIS356070325
Entity Name: Cisco
Entity Type: Technology Company
Industry: Networking and Communications
Incident : Vulnerability CIS606071825
Entity Name: Cisco
Entity Type: Organization
Industry: Technology
Incident : Vulnerability Exploitation CIS958072325
Entity Name: Cisco Systems
Entity Type: Corporation
Industry: Technology
Location: Global
Size: Large Enterprise
Incident : Data Breach CIS747072825
Entity Name: Cisco Systems, Inc.
Entity Type: Company
Industry: Technology
Location: California
Incident : Remote Code Execution CIS905072925
Entity Name: Cisco
Entity Type: Vendor
Industry: Technology
Incident : Vulnerability Disclosure CIS751081525
Entity Name: Cisco Systems, Inc.
Entity Type: Corporation
Industry: Networking Hardware, Cybersecurity
Location: San Jose, California, USA
Size: Large Enterprise
Incident : Vulnerability Exploitation CIS834081625
Entity Name: Cisco Systems
Entity Type: Corporation
Industry: Networking Hardware/Software
Location: San Jose, California, USA
Size: Large (Enterprise)
Customers Affected: Organizations using Cisco FMC Software (versions 7.0.7 or 7.7.0) with RADIUS authentication enabled
Incident : Zero-day Exploitation CIS2892128092425
Entity Name: Cisco Systems, Inc.
Entity Type: Corporation
Industry: Networking Hardware/Software
Location: Global
Incident : Zero-day exploitation CIS5262052092625
Entity Name: Multiple government agencies (unspecified)
Entity Type: Government
Industry: Public sector
Location: United KingdomCanada (advisory issued)
Incident : Zero-day exploitation CIS5262052092625
Entity Name: Cisco Systems
Entity Type: Corporation
Industry: Networking/IT Security
Location: Global
Size: Large enterprise
Customers Affected: Users of Cisco ASA 5500-X Series devices
Incident : Espionage CIS5802058092725
Entity Name: Cisco Systems, Inc.
Entity Type: Technology Company
Industry: Networking and Cybersecurity
Location: Global (headquartered in San Jose, California, USA)
Size: Large (Enterprise)
Customers Affected: Critical infrastructure sectors (municipal, provincial, territorial governments; academia; research facilities; organizations using Cisco ASA for VPNs)
Incident : Espionage CIS5802058092725
Entity Name: Critical Infrastructure Sectors (Canada, U.S., UK, and Five Eyes Allies)
Entity Type: Government, Academia, Research Facilities
Industry: Multiple (Public Sector, Education, Research)
Location: CanadaUnited StatesUnited KingdomFive Eyes Alliance Nations
Incident : Cyberattack CIS2032020092825
Entity Name: United States Federal Government
Entity Type: Government
Industry: Public Sector
Location: United States
Incident : Cyberattack CIS2032020092825
Entity Name: U.S. Cybersecurity and Information Technology Infrastructure Agency (CISA)
Entity Type: Government Agency
Industry: Cybersecurity
Location: United States
Incident : Cyberattack CIS2032020092825
Entity Name: U.S. Federal Courts
Entity Type: Judicial Branch
Industry: Legal
Location: United States
Incident : Cyberattack CIS2032020092825
Entity Name: Cisco Systems
Entity Type: Corporation
Industry: Networking & Cybersecurity
Location: United States (Global)
Customers Affected: U.S. government agencies (hundreds of firewall devices)
Incident : Vulnerability Exploitation CIS0692106093025
Entity Name: Cisco Systems, Inc.
Entity Type: Technology Vendor
Industry: Networking and Cybersecurity
Location: Global
Size: Large Enterprise
Customers Affected: 50,000+ (exposed ASA/FTD appliances)
Incident : Vulnerability Exploitation CIS0692106093025
Entity Name: Federal Civilian Executive Branch (FCEB) Agencies (U.S.)
Entity Type: Government
Industry: Public Sector
Location: United States
Incident : Vulnerability Exploitation CIS0692106093025
Entity Name: Organizations Using Cisco ASA/FTD (Global)
Entity Type: Private Sector, Public Sector, Critical Infrastructure
Industry: Multiple
Location: United States (19,200+ endpoints)United Kingdom (2,800)Japan (2,300)Germany (2,200)Russia (2,100)Canada (1,500)Denmark (1,200)
Incident : Ransomware CIS0702107111125
Entity Name: Unnamed Bank (Pennsylvania)
Entity Type: Financial Institution
Industry: Banking
Location: Pennsylvania, USA
Incident : Ransomware CIS0702107111125
Entity Name: Unnamed Telecommunications Company (California)
Entity Type: Private Company
Industry: Telecommunications
Location: California, USA
Incident : Ransomware CIS0702107111125
Entity Name: Unnamed Engineering Firm (Michigan)
Entity Type: Private Company
Industry: Engineering
Location: Michigan, USA
Incident : Ransomware CIS0702107111125
Entity Name: Unnamed Organization (Illinois)
Location: Illinois, USA
Incident : Ransomware CIS0702107111125
Entity Name: Unnamed Organization (Georgia)
Location: Georgia, USA
Incident : Ransomware CIS0702107111125
Entity Name: Cisco Systems
Entity Type: Public Company
Industry: Technology/Networking
Location: California, USA
Size: Large Enterprise
Incident : Ransomware CIS0702107111125
Entity Name: Walmart
Entity Type: Public Company
Industry: Retail
Location: Arkansas, USA
Size: Large Enterprise
Incident : ransomware CIS2802228111125
Entity Name: Philadelphia-based company
Location: Philadelphia, Pennsylvania, U.S.
Incident : ransomware CIS2802228111125
Entity Name: Engineering firm
Industry: engineering
Location: 19 U.S. offices (exact locations unspecified)
Incident : ransomware CIS2802228111125
Entity Name: Michigan bank
Entity Type: bank
Industry: financial services
Location: Michigan, U.S.
Incident : ransomware CIS2802228111125
Entity Name: Ohio telecommunications provider
Entity Type: telecommunications
Industry: telecommunications
Location: Ohio, U.S.
Incident : ransomware CIS2802228111125
Entity Name: Business in the Eastern District of Pennsylvania
Location: Eastern District of Pennsylvania, U.S.
Incident : ransomware CIS2802228111125
Entity Name: Cisco
Entity Type: technology corporation
Industry: IT/Networking
Location: global (HQ: San Jose, California, U.S.)
Size: large enterprise
Incident : Vulnerability CIS4992749111425
Entity Name: Cisco Systems
Entity Type: Corporation
Industry: Networking Hardware/Software
Location: Global
Size: Large Enterprise
Response to the Incidents
What measures were taken in response to each incident ?
Incident : Ransomware CIS0217922
Containment Measures: Took action to contain and eradicate the bad actors
Incident : Security Vulnerabilities SPL355032725
Remediation Measures: Patches provided to usersSuggested updates to remediate risk
Incident : Vulnerability Exploitation CIS221051225
Remediation Measures: Patching
Incident : Software Vulnerability CIS719053025
Containment Measures: Disable the Out-of-Band AP Image Download feature
Remediation Measures: Software updates and patches
Incident : Privilege Escalation CIS616060625
Containment Measures: Network segmentationMulti-factor authentication (MFA)Disable unnecessary servicesImplement strict firewall rulesRegular auditing of administrative accounts
Remediation Measures: Update to the latest firmware versions
Network Segmentation: Isolate management interfaces from production networks
Enhanced Monitoring: Monitor for suspicious activities in SIEM systems
Incident : Remote Access Vulnerability CIS356070325
Containment Measures: Apply patch ciscocm.CSCwp27755_D0247-1.cop.sha512Upgrade to 15SU3 release
Remediation Measures: Monitor system logs for unauthorized root accessExamine /var/log/active/syslog/secure file for indicators of compromise
Enhanced Monitoring: Monitor system logs for unauthorized root access
Incident : Vulnerability CIS606071825
Remediation Measures: Upgrade to ISE 3.3 Patch 7 or ISE 3.4 Patch 2
Incident : Vulnerability Exploitation CIS958072325
Containment Measures: Immediate patching
Remediation Measures: Apply patches and enhanced fixed releases
Communication Strategy: Public advisory and urgent calls for patching
Incident : Remote Code Execution CIS905072925
Containment Measures: Apply security updates
Remediation Measures: Update to 3.3 Patch 7 and 3.4 Patch 2
Incident : Vulnerability Disclosure CIS751081525
Incident Response Plan Activated: True
Containment Measures: Disable RADIUS authentication (switch to LDAP/SAML/local accounts)
Remediation Measures: Apply free software updates provided by Cisco
Communication Strategy: Public advisory via Cisco’s August 2025 Semiannual Security Advisory Bundled PublicationUrgent recommendation for immediate patching
Incident : Vulnerability Exploitation CIS834081625
Containment Measures: Urgent patching advisory issued by Cisco
Remediation Measures: Apply software updates to affected FMC versionsReview RADIUS authentication configurations
Communication Strategy: Public security advisory released by Cisco
Enhanced Monitoring: Recommended: Monitor for unauthorized access attempts targeting FMC interfaces
Incident : Zero-day Exploitation CIS2892128092425
Incident Response Plan Activated: True
Containment Measures: Limiting SNMP access to trusted users (temporary mitigation)
Remediation Measures: Applying security patches for CVE-2025-20352, CVE-2025-20240, and CVE-2025-20149
Communication Strategy: Public advisory via Cisco PSIRTRecommendation for immediate patching
Incident : Zero-day exploitation CIS5262052092625
Incident Response Plan Activated: True
Third Party Assistance: U.K. National Cyber Security Centre (Ncsc), Canadian Centre For Cyber Security.
Containment Measures: Cisco patches for CVE-2025-20362, CVE-2025-20333, CVE-2025-20363Urgent advisories for updatesDisabling VPN web services on vulnerable devices
Remediation Measures: Firmware analysis to detect RayInitiator/LINE VIPERReplacement of end-of-support (EoS) devicesImplementation of Secure Boot/Trust Anchor on newer models
Communication Strategy: Public advisories by NCSC (2025-09-25)Cisco security bulletinsCanadian Centre for Cyber Security alerts
Enhanced Monitoring: Recommended for ASA/FTD devices
Incident : Espionage CIS5802058092725
Incident Response Plan Activated: True
Third Party Assistance: Five Eyes Intelligence Alliance, Cisco Internal Teams.
Containment Measures: Urgent Patching of Cisco ASA VulnerabilitiesEmergency Directives (e.g., U.S. CISA's midnight deadline for federal agencies)
Communication Strategy: Public Warnings by CSE (Canada), CISA (U.S.), NCSC (UK)Media Statements (e.g., CBC News)Collaboration with Five Eyes Alliance
Enhanced Monitoring: Recommended (implied by urgency of patching and detection evasion concerns)
Incident : Cyberattack CIS2032020092825
Incident Response Plan Activated: True
Third Party Assistance: Cisco Cybersecurity Experts.
Containment Measures: CISA directive to identify affected devicesData collection and threat assessment using CISA tools
Remediation Measures: Patching vulnerabilities (CVE-2024-20353, CVE-2024-20359)Addressing cyber vulnerabilities in Cisco devices
Communication Strategy: Public disclosure via BloombergCISA advisories
Enhanced Monitoring: Use of CISA cybersecurity tools for threat assessment
Incident : Vulnerability Exploitation CIS0692106093025
Incident Response Plan Activated: ['Cisco Security Advisory (2024-09-25)', 'CISA Emergency Directive (24-hour patching mandate)', 'NCSC (UK) Threat Report']
Third Party Assistance: The Shadowserver Foundation (Threat Monitoring), Greynoise (Early Warning Scans).
Containment Measures: Restrict VPN Web Interface ExposureDisconnect End-of-Support (EoS) ASA DevicesIncrease Logging/Monitoring for Suspicious VPN Logins
Remediation Measures: Apply Cisco Patches for CVE-2025-20333 and CVE-2025-20362Follow Cisco Hardening Guidelines
Communication Strategy: Cisco Security Advisories [1, 2]CISA Emergency DirectiveNCSC Threat Report
Enhanced Monitoring: Monitor for Crafted HTTP RequestsTrack Suspicious VPN Logins
Incident : Ransomware CIS0702107111125
Third Party Assistance: Fbi Investigation, Symantec (Threat Intelligence), Kaspersky (Decryption Tool).
Remediation Measures: Kaspersky released free decrypter (2022)
Incident : ransomware CIS2802228111125
Incident Response Plan Activated: True
Third Party Assistance: Fbi, International Law Enforcement (Italy).
Incident : Vulnerability CIS4992749111425
Incident Response Plan Activated: True
Containment Measures: Immediate software upgrade to patched versions (e.g., 2.3.7.10-VA)
Remediation Measures: No workarounds; mandatory patching
Communication Strategy: Public security advisoryDirect customer notifications via TAC
What is the company's incident response plan?
Incident Response Plan: The company's incident response plan is described as Cisco Security Advisory (2024-09-25), CISA Emergency Directive (24-hour patching mandate), NCSC (UK) Threat Report, , , .
How does the company involve third-party assistance in incident response ?
Third-Party Assistance: The company involves third-party assistance in incident response through U.K. National Cyber Security Centre (NCSC), Canadian Centre for Cyber Security, , Five Eyes Intelligence Alliance, Cisco Internal Teams, , Cisco Cybersecurity Experts, , The Shadowserver Foundation (Threat Monitoring), Greynoise (Early Warning Scans), , FBI Investigation, Symantec (Threat Intelligence), Kaspersky (Decryption Tool), , FBI, international law enforcement (Italy), .
Data Breach Information
What type of data was compromised in each breach ?
Incident : Ransomware CIS0217922
Type of Data Compromised: Cisco products or services, Sensitive customer data, Sensitive employee information, Intellectual property, Supply chain operations
Sensitivity of Data: High
Data Exfiltration: 2.8GB
Incident : Data Breach CIS193201022
Incident : Data Leak CIS193291022
Type of Data Compromised: Non-sensitive files, Classified documents, Technical schematics, Source code
Sensitivity of Data: non-sensitivehigh
File Types Exposed: documentsschematicssource code
Incident : Data Leak CIS1221121123
Type of Data Compromised: Personal details, Professional profile, Educational background, Cover letter, Resume content
Personally Identifiable Information: nameemail addressphone numbersecurity question answers
Incident : Security Breach CIS741040125
Type of Data Compromised: Sensitive Information
Sensitivity of Data: High
Incident : Vulnerability Exploitation CIS929041225
Type of Data Compromised: Sensitive Data
Sensitivity of Data: High
Incident : Data Breach CIS747072825
Type of Data Compromised: Personal information
Sensitivity of Data: High
Personally Identifiable Information: namesaddressesemailsphone numbers
Incident : Zero-day exploitation CIS5262052092625
Type of Data Compromised: Vpn authentication data, Cli command history, Network packet captures, Potential government data
Sensitivity of Data: High (government agencies targeted)Potential classified information
Data Exfiltration: Likely (via LINE VIPER C2 channels)
Incident : Espionage CIS5802058092725
Data Exfiltration: Potential (malware designed for exfiltration)
Incident : Cyberattack CIS2032020092825
Type of Data Compromised: Classified government documents, Espionage-related data, Fraud/money laundering records, Foreign agent activities
Sensitivity of Data: High (Classified)
Incident : Ransomware CIS0702107111125
Data Exfiltration: Likely (based on ransomware MO)
Data Encryption: ['Yanluowang custom encryption (vulnerability found by Kaspersky)']
Incident : ransomware CIS2802228111125
Type of Data Compromised: Corporate network credentials, Stolen data (unspecified), Non-sensitive files (cisco box folder)
Sensitivity of Data: low (Cisco case: non-sensitive files)high (credentials, corporate data)
Data Encryption: True
What measures does the company take to prevent data exfiltration ?
Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Patches provided to users, Suggested updates to remediate risk, , Patching, Software updates and patches, Update to the latest firmware versions, , Monitor system logs for unauthorized root access, Examine /var/log/active/syslog/secure file for indicators of compromise, , Upgrade to ISE 3.3 Patch 7 or ISE 3.4 Patch 2, , Apply patches and enhanced fixed releases, Update to 3.3 Patch 7 and 3.4 Patch 2, Apply free software updates provided by Cisco, , Apply software updates to affected FMC versions, Review RADIUS authentication configurations, , Applying security patches for CVE-2025-20352, CVE-2025-20240, and CVE-2025-20149, , Firmware analysis to detect RayInitiator/LINE VIPER, Replacement of end-of-support (EoS) devices, Implementation of Secure Boot/Trust Anchor on newer models, , Patching vulnerabilities (CVE-2024-20353, CVE-2024-20359), Addressing cyber vulnerabilities in Cisco devices, , Apply Cisco Patches for CVE-2025-20333 and CVE-2025-20362, Follow Cisco Hardening Guidelines, , Kaspersky released free decrypter (2022), , No workarounds; mandatory patching, .
How does the company handle incidents involving personally identifiable information (PII) ?
Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by took action to contain and eradicate the bad actors, , disable the out-of-band ap image download feature, network segmentation, multi-factor authentication (mfa), disable unnecessary services, implement strict firewall rules, regular auditing of administrative accounts, , apply patch ciscocm.cscwp27755_d0247-1.cop.sha512, upgrade to 15su3 release, , immediate patching, apply security updates, disable radius authentication (switch to ldap/saml/local accounts), , urgent patching advisory issued by cisco, , limiting snmp access to trusted users (temporary mitigation), , cisco patches for cve-2025-20362, cve-2025-20333, cve-2025-20363, urgent advisories for updates, disabling vpn web services on vulnerable devices, , urgent patching of cisco asa vulnerabilities, emergency directives (e.g., u.s. cisa's midnight deadline for federal agencies), , cisa directive to identify affected devices, data collection and threat assessment using cisa tools, , restrict vpn web interface exposure, disconnect end-of-support (eos) asa devices, increase logging/monitoring for suspicious vpn logins, , immediate software upgrade to patched versions (e.g., 2.3.7.10-va) and .
Ransomware Information
Was ransomware involved in any of the incidents ?
Incident : Cyberattack CIS2032020092825
Data Exfiltration: True
Incident : Ransomware CIS0702107111125
Ransom Demanded: $1.5M+ (confirmed from two victims)
Ransom Paid: $1.5M+ (confirmed)
Ransomware Strain: Yanluowang
Data Encryption: True
Data Exfiltration: ['Double Extortion (likely)']
Incident : ransomware CIS2802228111125
Ransom Demanded: $300,000 to $15,000,000 (per victim)
Ransom Paid: $1,500,000 (total from two victims)
Ransomware Strain: Yanluowang
Data Encryption: True
Data Exfiltration: True
Regulatory Compliance
Were there any regulatory violations and fines imposed for each incident ?
Incident : Zero-day exploitation CIS5262052092625
Regulatory Notifications: U.K. NCSC advisory (2025-09-25)Canadian Centre for Cyber Security advisory
Incident : Espionage CIS5802058092725
Regulatory Notifications: Emergency Directives (e.g., U.S. CISA)Public Advisories (CSE, NCSC)
Incident : Cyberattack CIS2032020092825
Regulatory Notifications: CISA directives to federal agencies
Incident : Vulnerability Exploitation CIS0692106093025
Regulations Violated: CISA Emergency Directive (Non-Compliance Risk for Federal Agencies),
Regulatory Notifications: CISA Mandate for Federal AgenciesNCSC (UK) Advisory
Incident : Ransomware CIS0702107111125
Legal Actions: U.S. Federal Charges (hacking, theft, extortion), Plea Deal (2025-10-29), Extradition from Italy (2023),
Incident : ransomware CIS2802228111125
Legal Actions: arrest (Italy, January 2024), extradition to U.S., guilty plea (October 29, 2024), charges: unlawful transfer of means of identification, trafficking in access information, access device fraud, aggravated identity theft, conspiracy to commit computer fraud, conspiracy to commit money laundering,
How does the company ensure compliance with regulatory requirements ?
Ensuring Regulatory Compliance: The company ensures compliance with regulatory requirements through U.S. Federal Charges (hacking, theft, extortion), Plea Deal (2025-10-29), Extradition from Italy (2023), , arrest (Italy, January 2024), extradition to U.S., guilty plea (October 29, 2024), charges: unlawful transfer of means of identification, trafficking in access information, access device fraud, aggravated identity theft, conspiracy to commit computer fraud, conspiracy to commit money laundering, .
Lessons Learned and Recommendations
What lessons were learned from each incident ?
Incident : Security Vulnerabilities SPL355032725
Lessons Learned: The critical importance of maintaining updated systems and monitoring access control within corporate environments to prevent data breaches and maintain operational integrity.
Incident : Software Vulnerability CIS719053025
Lessons Learned: Immediate patching and auditing of wireless infrastructure to identify exposed systems.
Incident : Remote Access Vulnerability CIS356070325
Lessons Learned: Immediate patching or system updates are the only effective mitigation strategy for critical vulnerabilities.
Incident : Vulnerability Exploitation CIS958072325
Lessons Learned: Immediate patching is crucial for mitigating critical vulnerabilities
Incident : Vulnerability Disclosure CIS751081525
Lessons Learned: Proactive internal security testing can uncover critical vulnerabilities before exploitation (discovered by Brandon Sakai of Cisco)., Vulnerabilities in authentication systems (e.g., RADIUS) can have severe impacts if input validation is insufficient., Lack of workarounds for critical flaws underscores the importance of patch management and alternative mitigation strategies (e.g., disabling vulnerable features).
Incident : Vulnerability Exploitation CIS834081625
Lessons Learned: Critical importance of patching network security management systems promptly, Risks associated with improper input validation in authentication protocols, Need for defense-in-depth when using RADIUS for administrative access
Incident : Zero-day exploitation CIS5262052092625
Lessons Learned: End-of-support (EoS) devices pose significant risks even if functional, Advanced threat actors leverage multi-stage malware (bootkits + shellcode loaders) to evade detection, Persistence mechanisms (e.g., ROMMON modifications) can survive reboots/upgrades on legacy hardware, VPN web services are a high-value target for APT groups, Secure Boot/Trust Anchor technologies are critical for mitigating firmware-level attacks
Incident : Vulnerability Exploitation CIS0692106093025
Lessons Learned: Proactive Patching is Critical for Zero-Day Vulnerabilities, Exposed VPN Interfaces Are High-Risk Targets, Federal Directives Can Accelerate Response in Critical Infrastructure, Threat Intelligence Sharing (e.g., Shadowserver, Greynoise) Provides Early Warnings
Incident : Ransomware CIS0702107111125
Lessons Learned: Initial access brokers play a critical role in ransomware ecosystems, enabling attacks by selling pre-compromised access., Threat actors often masquerade as other nationalities (e.g., Yanluowang posed as Chinese but was Russian)., Cryptocurrency tracing and digital breadcrumbs (e.g., email, Apple ID) are vital for attribution., Collaboration between cybersecurity firms (Symantec, Kaspersky) and law enforcement (FBI) can disrupt ransomware operations., Leaked internal chats can expose operational details and debunk threat actor personas.
Incident : Vulnerability CIS4992749111425
Lessons Learned: Proactive internal vulnerability discovery (via TAC) highlights the importance of rigorous code review., Lack of workarounds underscores the need for timely patch management in critical infrastructure., Observer-level accounts can serve as attack vectors; least-privilege principles must be enforced.
What recommendations were made to prevent future incidents ?
Incident : Vulnerability Exploitation CIS221051225
Recommendations: Users should patch immediately.
Incident : Software Vulnerability CIS719053025
Recommendations: Organizations should disable the Out-of-Band AP Image Download feature and apply software updates.
Incident : Privilege Escalation CIS616060625
Recommendations: Update to the latest firmware versions, Configure proper network segmentation, Implement multi-factor authentication (MFA), Disable unnecessary services, Implement strict firewall rules, Regularly audit user accounts with administrative privileges, Monitor for suspicious activities in SIEM systemsUpdate to the latest firmware versions, Configure proper network segmentation, Implement multi-factor authentication (MFA), Disable unnecessary services, Implement strict firewall rules, Regularly audit user accounts with administrative privileges, Monitor for suspicious activities in SIEM systemsUpdate to the latest firmware versions, Configure proper network segmentation, Implement multi-factor authentication (MFA), Disable unnecessary services, Implement strict firewall rules, Regularly audit user accounts with administrative privileges, Monitor for suspicious activities in SIEM systemsUpdate to the latest firmware versions, Configure proper network segmentation, Implement multi-factor authentication (MFA), Disable unnecessary services, Implement strict firewall rules, Regularly audit user accounts with administrative privileges, Monitor for suspicious activities in SIEM systemsUpdate to the latest firmware versions, Configure proper network segmentation, Implement multi-factor authentication (MFA), Disable unnecessary services, Implement strict firewall rules, Regularly audit user accounts with administrative privileges, Monitor for suspicious activities in SIEM systemsUpdate to the latest firmware versions, Configure proper network segmentation, Implement multi-factor authentication (MFA), Disable unnecessary services, Implement strict firewall rules, Regularly audit user accounts with administrative privileges, Monitor for suspicious activities in SIEM systemsUpdate to the latest firmware versions, Configure proper network segmentation, Implement multi-factor authentication (MFA), Disable unnecessary services, Implement strict firewall rules, Regularly audit user accounts with administrative privileges, Monitor for suspicious activities in SIEM systems
Incident : Remote Access Vulnerability CIS356070325
Recommendations: Organizations should prioritize updating affected systems immediately.
Incident : Vulnerability CIS606071825
Recommendations: System administrators should take immediate action to mitigate risks, Ensure devices have enough memory before upgrading, Test and confirm current configurations for hardware and software componentsSystem administrators should take immediate action to mitigate risks, Ensure devices have enough memory before upgrading, Test and confirm current configurations for hardware and software componentsSystem administrators should take immediate action to mitigate risks, Ensure devices have enough memory before upgrading, Test and confirm current configurations for hardware and software components
Incident : Vulnerability Exploitation CIS958072325
Recommendations: Verify ISE versions and apply necessary patches
Incident : Remote Code Execution CIS905072925
Recommendations: Apply the patches as directed in the vendor's bulletin.
Incident : Vulnerability Disclosure CIS751081525
Recommendations: Immediately patch affected Cisco Secure FMC Software (versions 7.0.7, 7.7.0) to the latest release., Disable RADIUS authentication if patching is not immediately feasible, and switch to LDAP, SAML SSO, or local accounts., Prioritize this vulnerability as a 'priority-one' patching scenario due to its critical severity (CVSS 10.0) and potential for unauthenticated remote code execution., Conduct a review of all authentication mechanisms in enterprise firewall infrastructure to identify similar input validation risks., Monitor for unusual authentication attempts or command execution on FMC systems until patches are applied.Immediately patch affected Cisco Secure FMC Software (versions 7.0.7, 7.7.0) to the latest release., Disable RADIUS authentication if patching is not immediately feasible, and switch to LDAP, SAML SSO, or local accounts., Prioritize this vulnerability as a 'priority-one' patching scenario due to its critical severity (CVSS 10.0) and potential for unauthenticated remote code execution., Conduct a review of all authentication mechanisms in enterprise firewall infrastructure to identify similar input validation risks., Monitor for unusual authentication attempts or command execution on FMC systems until patches are applied.Immediately patch affected Cisco Secure FMC Software (versions 7.0.7, 7.7.0) to the latest release., Disable RADIUS authentication if patching is not immediately feasible, and switch to LDAP, SAML SSO, or local accounts., Prioritize this vulnerability as a 'priority-one' patching scenario due to its critical severity (CVSS 10.0) and potential for unauthenticated remote code execution., Conduct a review of all authentication mechanisms in enterprise firewall infrastructure to identify similar input validation risks., Monitor for unusual authentication attempts or command execution on FMC systems until patches are applied.Immediately patch affected Cisco Secure FMC Software (versions 7.0.7, 7.7.0) to the latest release., Disable RADIUS authentication if patching is not immediately feasible, and switch to LDAP, SAML SSO, or local accounts., Prioritize this vulnerability as a 'priority-one' patching scenario due to its critical severity (CVSS 10.0) and potential for unauthenticated remote code execution., Conduct a review of all authentication mechanisms in enterprise firewall infrastructure to identify similar input validation risks., Monitor for unusual authentication attempts or command execution on FMC systems until patches are applied.Immediately patch affected Cisco Secure FMC Software (versions 7.0.7, 7.7.0) to the latest release., Disable RADIUS authentication if patching is not immediately feasible, and switch to LDAP, SAML SSO, or local accounts., Prioritize this vulnerability as a 'priority-one' patching scenario due to its critical severity (CVSS 10.0) and potential for unauthenticated remote code execution., Conduct a review of all authentication mechanisms in enterprise firewall infrastructure to identify similar input validation risks., Monitor for unusual authentication attempts or command execution on FMC systems until patches are applied.
Incident : Vulnerability Exploitation CIS834081625
Recommendations: Immediately apply Cisco's patch for affected FMC versions (7.0.7, 7.7.0), Review and harden RADIUS authentication configurations, Implement network segmentation for firewall management interfaces, Enable multi-factor authentication for FMC access where possible, Monitor authentication logs for anomalous activityImmediately apply Cisco's patch for affected FMC versions (7.0.7, 7.7.0), Review and harden RADIUS authentication configurations, Implement network segmentation for firewall management interfaces, Enable multi-factor authentication for FMC access where possible, Monitor authentication logs for anomalous activityImmediately apply Cisco's patch for affected FMC versions (7.0.7, 7.7.0), Review and harden RADIUS authentication configurations, Implement network segmentation for firewall management interfaces, Enable multi-factor authentication for FMC access where possible, Monitor authentication logs for anomalous activityImmediately apply Cisco's patch for affected FMC versions (7.0.7, 7.7.0), Review and harden RADIUS authentication configurations, Implement network segmentation for firewall management interfaces, Enable multi-factor authentication for FMC access where possible, Monitor authentication logs for anomalous activityImmediately apply Cisco's patch for affected FMC versions (7.0.7, 7.7.0), Review and harden RADIUS authentication configurations, Implement network segmentation for firewall management interfaces, Enable multi-factor authentication for FMC access where possible, Monitor authentication logs for anomalous activity
Incident : Zero-day Exploitation CIS2892128092425
Recommendations: Upgrade to fixed software releases immediately, Limit SNMP access to trusted users if patching is delayed, Monitor for signs of exploitation (e.g., unexpected SNMP traffic, DoS symptoms), Review Administrator credential security post-compromiseUpgrade to fixed software releases immediately, Limit SNMP access to trusted users if patching is delayed, Monitor for signs of exploitation (e.g., unexpected SNMP traffic, DoS symptoms), Review Administrator credential security post-compromiseUpgrade to fixed software releases immediately, Limit SNMP access to trusted users if patching is delayed, Monitor for signs of exploitation (e.g., unexpected SNMP traffic, DoS symptoms), Review Administrator credential security post-compromiseUpgrade to fixed software releases immediately, Limit SNMP access to trusted users if patching is delayed, Monitor for signs of exploitation (e.g., unexpected SNMP traffic, DoS symptoms), Review Administrator credential security post-compromise
Incident : Zero-day exploitation CIS5262052092625
Recommendations: Immediately patch CVE-2025-20362, CVE-2025-20333, and CVE-2025-20363, Replace end-of-support Cisco ASA 5500-X Series devices, Enable Secure Boot and Trust Anchor on supported devices, Disable VPN web services if not essential, Monitor for unusual CLI command activity or syslog suppression, Deploy network segmentation to limit lateral movement, Conduct forensic analysis of ASA firmware for signs of RayInitiator/LINE VIPER, Implement behavioral detection for ICMP/TCP and WebVPN C2 trafficImmediately patch CVE-2025-20362, CVE-2025-20333, and CVE-2025-20363, Replace end-of-support Cisco ASA 5500-X Series devices, Enable Secure Boot and Trust Anchor on supported devices, Disable VPN web services if not essential, Monitor for unusual CLI command activity or syslog suppression, Deploy network segmentation to limit lateral movement, Conduct forensic analysis of ASA firmware for signs of RayInitiator/LINE VIPER, Implement behavioral detection for ICMP/TCP and WebVPN C2 trafficImmediately patch CVE-2025-20362, CVE-2025-20333, and CVE-2025-20363, Replace end-of-support Cisco ASA 5500-X Series devices, Enable Secure Boot and Trust Anchor on supported devices, Disable VPN web services if not essential, Monitor for unusual CLI command activity or syslog suppression, Deploy network segmentation to limit lateral movement, Conduct forensic analysis of ASA firmware for signs of RayInitiator/LINE VIPER, Implement behavioral detection for ICMP/TCP and WebVPN C2 trafficImmediately patch CVE-2025-20362, CVE-2025-20333, and CVE-2025-20363, Replace end-of-support Cisco ASA 5500-X Series devices, Enable Secure Boot and Trust Anchor on supported devices, Disable VPN web services if not essential, Monitor for unusual CLI command activity or syslog suppression, Deploy network segmentation to limit lateral movement, Conduct forensic analysis of ASA firmware for signs of RayInitiator/LINE VIPER, Implement behavioral detection for ICMP/TCP and WebVPN C2 trafficImmediately patch CVE-2025-20362, CVE-2025-20333, and CVE-2025-20363, Replace end-of-support Cisco ASA 5500-X Series devices, Enable Secure Boot and Trust Anchor on supported devices, Disable VPN web services if not essential, Monitor for unusual CLI command activity or syslog suppression, Deploy network segmentation to limit lateral movement, Conduct forensic analysis of ASA firmware for signs of RayInitiator/LINE VIPER, Implement behavioral detection for ICMP/TCP and WebVPN C2 trafficImmediately patch CVE-2025-20362, CVE-2025-20333, and CVE-2025-20363, Replace end-of-support Cisco ASA 5500-X Series devices, Enable Secure Boot and Trust Anchor on supported devices, Disable VPN web services if not essential, Monitor for unusual CLI command activity or syslog suppression, Deploy network segmentation to limit lateral movement, Conduct forensic analysis of ASA firmware for signs of RayInitiator/LINE VIPER, Implement behavioral detection for ICMP/TCP and WebVPN C2 trafficImmediately patch CVE-2025-20362, CVE-2025-20333, and CVE-2025-20363, Replace end-of-support Cisco ASA 5500-X Series devices, Enable Secure Boot and Trust Anchor on supported devices, Disable VPN web services if not essential, Monitor for unusual CLI command activity or syslog suppression, Deploy network segmentation to limit lateral movement, Conduct forensic analysis of ASA firmware for signs of RayInitiator/LINE VIPER, Implement behavioral detection for ICMP/TCP and WebVPN C2 trafficImmediately patch CVE-2025-20362, CVE-2025-20333, and CVE-2025-20363, Replace end-of-support Cisco ASA 5500-X Series devices, Enable Secure Boot and Trust Anchor on supported devices, Disable VPN web services if not essential, Monitor for unusual CLI command activity or syslog suppression, Deploy network segmentation to limit lateral movement, Conduct forensic analysis of ASA firmware for signs of RayInitiator/LINE VIPER, Implement behavioral detection for ICMP/TCP and WebVPN C2 traffic
Incident : Espionage CIS5802058092725
Recommendations: Immediate patching of Cisco ASA vulnerabilities as per vendor and cyber agency guidelines., Enhanced monitoring for signs of compromise, especially in legacy systems., Collaboration with cybersecurity agencies (e.g., CSE, CISA, NCSC) for threat intelligence sharing., Review and update incident response plans for state-sponsored APTs., Prioritize security updates for VPN and remote access infrastructure.Immediate patching of Cisco ASA vulnerabilities as per vendor and cyber agency guidelines., Enhanced monitoring for signs of compromise, especially in legacy systems., Collaboration with cybersecurity agencies (e.g., CSE, CISA, NCSC) for threat intelligence sharing., Review and update incident response plans for state-sponsored APTs., Prioritize security updates for VPN and remote access infrastructure.Immediate patching of Cisco ASA vulnerabilities as per vendor and cyber agency guidelines., Enhanced monitoring for signs of compromise, especially in legacy systems., Collaboration with cybersecurity agencies (e.g., CSE, CISA, NCSC) for threat intelligence sharing., Review and update incident response plans for state-sponsored APTs., Prioritize security updates for VPN and remote access infrastructure.Immediate patching of Cisco ASA vulnerabilities as per vendor and cyber agency guidelines., Enhanced monitoring for signs of compromise, especially in legacy systems., Collaboration with cybersecurity agencies (e.g., CSE, CISA, NCSC) for threat intelligence sharing., Review and update incident response plans for state-sponsored APTs., Prioritize security updates for VPN and remote access infrastructure.Immediate patching of Cisco ASA vulnerabilities as per vendor and cyber agency guidelines., Enhanced monitoring for signs of compromise, especially in legacy systems., Collaboration with cybersecurity agencies (e.g., CSE, CISA, NCSC) for threat intelligence sharing., Review and update incident response plans for state-sponsored APTs., Prioritize security updates for VPN and remote access infrastructure.
Incident : Vulnerability Exploitation CIS0692106093025
Recommendations: Immediately Patch CVE-2025-20333 and CVE-2025-20362 on All Cisco ASA/FTD Devices, Restrict Public Exposure of VPN Web Interfaces, Deploy Enhanced Monitoring for Suspicious HTTP Requests and VPN Logins, Disconnect End-of-Support (EoS) Devices from Networks, Follow CISA and NCSC Guidelines for Hardening Network Perimeters, Conduct Threat Hunting for 'Line Viper' and 'RayInitiator' MalwareImmediately Patch CVE-2025-20333 and CVE-2025-20362 on All Cisco ASA/FTD Devices, Restrict Public Exposure of VPN Web Interfaces, Deploy Enhanced Monitoring for Suspicious HTTP Requests and VPN Logins, Disconnect End-of-Support (EoS) Devices from Networks, Follow CISA and NCSC Guidelines for Hardening Network Perimeters, Conduct Threat Hunting for 'Line Viper' and 'RayInitiator' MalwareImmediately Patch CVE-2025-20333 and CVE-2025-20362 on All Cisco ASA/FTD Devices, Restrict Public Exposure of VPN Web Interfaces, Deploy Enhanced Monitoring for Suspicious HTTP Requests and VPN Logins, Disconnect End-of-Support (EoS) Devices from Networks, Follow CISA and NCSC Guidelines for Hardening Network Perimeters, Conduct Threat Hunting for 'Line Viper' and 'RayInitiator' MalwareImmediately Patch CVE-2025-20333 and CVE-2025-20362 on All Cisco ASA/FTD Devices, Restrict Public Exposure of VPN Web Interfaces, Deploy Enhanced Monitoring for Suspicious HTTP Requests and VPN Logins, Disconnect End-of-Support (EoS) Devices from Networks, Follow CISA and NCSC Guidelines for Hardening Network Perimeters, Conduct Threat Hunting for 'Line Viper' and 'RayInitiator' MalwareImmediately Patch CVE-2025-20333 and CVE-2025-20362 on All Cisco ASA/FTD Devices, Restrict Public Exposure of VPN Web Interfaces, Deploy Enhanced Monitoring for Suspicious HTTP Requests and VPN Logins, Disconnect End-of-Support (EoS) Devices from Networks, Follow CISA and NCSC Guidelines for Hardening Network Perimeters, Conduct Threat Hunting for 'Line Viper' and 'RayInitiator' MalwareImmediately Patch CVE-2025-20333 and CVE-2025-20362 on All Cisco ASA/FTD Devices, Restrict Public Exposure of VPN Web Interfaces, Deploy Enhanced Monitoring for Suspicious HTTP Requests and VPN Logins, Disconnect End-of-Support (EoS) Devices from Networks, Follow CISA and NCSC Guidelines for Hardening Network Perimeters, Conduct Threat Hunting for 'Line Viper' and 'RayInitiator' Malware
Incident : Ransomware CIS0702107111125
Recommendations: Monitor dark web forums for initial access brokerage activity targeting your industry., Implement multi-factor authentication (MFA) and least-privilege access to thwart initial access brokers., Regularly audit cryptocurrency transactions for signs of ransomware payments., Prepare for double-extortion tactics (data encryption + exfiltration) in ransomware response plans., Leverage threat intelligence sharing to identify emerging ransomware strains like Yanluowang.Monitor dark web forums for initial access brokerage activity targeting your industry., Implement multi-factor authentication (MFA) and least-privilege access to thwart initial access brokers., Regularly audit cryptocurrency transactions for signs of ransomware payments., Prepare for double-extortion tactics (data encryption + exfiltration) in ransomware response plans., Leverage threat intelligence sharing to identify emerging ransomware strains like Yanluowang.Monitor dark web forums for initial access brokerage activity targeting your industry., Implement multi-factor authentication (MFA) and least-privilege access to thwart initial access brokers., Regularly audit cryptocurrency transactions for signs of ransomware payments., Prepare for double-extortion tactics (data encryption + exfiltration) in ransomware response plans., Leverage threat intelligence sharing to identify emerging ransomware strains like Yanluowang.Monitor dark web forums for initial access brokerage activity targeting your industry., Implement multi-factor authentication (MFA) and least-privilege access to thwart initial access brokers., Regularly audit cryptocurrency transactions for signs of ransomware payments., Prepare for double-extortion tactics (data encryption + exfiltration) in ransomware response plans., Leverage threat intelligence sharing to identify emerging ransomware strains like Yanluowang.Monitor dark web forums for initial access brokerage activity targeting your industry., Implement multi-factor authentication (MFA) and least-privilege access to thwart initial access brokers., Regularly audit cryptocurrency transactions for signs of ransomware payments., Prepare for double-extortion tactics (data encryption + exfiltration) in ransomware response plans., Leverage threat intelligence sharing to identify emerging ransomware strains like Yanluowang.
Incident : Vulnerability CIS4992749111425
Recommendations: Upgrade affected Cisco Catalyst Center Virtual Appliances to version 2.3.7.10-VA or later immediately., Audit user roles to minimize Observer-level access where unnecessary., Monitor for unusual privilege escalation attempts or unauthorized account creation., Subscribe to vendor security advisories (e.g., Cisco PSIRT) for real-time alerts.Upgrade affected Cisco Catalyst Center Virtual Appliances to version 2.3.7.10-VA or later immediately., Audit user roles to minimize Observer-level access where unnecessary., Monitor for unusual privilege escalation attempts or unauthorized account creation., Subscribe to vendor security advisories (e.g., Cisco PSIRT) for real-time alerts.Upgrade affected Cisco Catalyst Center Virtual Appliances to version 2.3.7.10-VA or later immediately., Audit user roles to minimize Observer-level access where unnecessary., Monitor for unusual privilege escalation attempts or unauthorized account creation., Subscribe to vendor security advisories (e.g., Cisco PSIRT) for real-time alerts.Upgrade affected Cisco Catalyst Center Virtual Appliances to version 2.3.7.10-VA or later immediately., Audit user roles to minimize Observer-level access where unnecessary., Monitor for unusual privilege escalation attempts or unauthorized account creation., Subscribe to vendor security advisories (e.g., Cisco PSIRT) for real-time alerts.
What are the key lessons learned from past incidents ?
Key Lessons Learned: The key lessons learned from past incidents are The critical importance of maintaining updated systems and monitoring access control within corporate environments to prevent data breaches and maintain operational integrity.Immediate patching and auditing of wireless infrastructure to identify exposed systems.Immediate patching or system updates are the only effective mitigation strategy for critical vulnerabilities.Immediate patching is crucial for mitigating critical vulnerabilitiesProactive internal security testing can uncover critical vulnerabilities before exploitation (discovered by Brandon Sakai of Cisco).,Vulnerabilities in authentication systems (e.g., RADIUS) can have severe impacts if input validation is insufficient.,Lack of workarounds for critical flaws underscores the importance of patch management and alternative mitigation strategies (e.g., disabling vulnerable features).Critical importance of patching network security management systems promptly,Risks associated with improper input validation in authentication protocols,Need for defense-in-depth when using RADIUS for administrative accessEnd-of-support (EoS) devices pose significant risks even if functional,Advanced threat actors leverage multi-stage malware (bootkits + shellcode loaders) to evade detection,Persistence mechanisms (e.g., ROMMON modifications) can survive reboots/upgrades on legacy hardware,VPN web services are a high-value target for APT groups,Secure Boot/Trust Anchor technologies are critical for mitigating firmware-level attacksProactive Patching is Critical for Zero-Day Vulnerabilities,Exposed VPN Interfaces Are High-Risk Targets,Federal Directives Can Accelerate Response in Critical Infrastructure,Threat Intelligence Sharing (e.g., Shadowserver, Greynoise) Provides Early WarningsInitial access brokers play a critical role in ransomware ecosystems, enabling attacks by selling pre-compromised access.,Threat actors often masquerade as other nationalities (e.g., Yanluowang posed as Chinese but was Russian).,Cryptocurrency tracing and digital breadcrumbs (e.g., email, Apple ID) are vital for attribution.,Collaboration between cybersecurity firms (Symantec, Kaspersky) and law enforcement (FBI) can disrupt ransomware operations.,Leaked internal chats can expose operational details and debunk threat actor personas.Proactive internal vulnerability discovery (via TAC) highlights the importance of rigorous code review.,Lack of workarounds underscores the need for timely patch management in critical infrastructure.,Observer-level accounts can serve as attack vectors; least-privilege principles must be enforced.
What recommendations has the company implemented to improve cybersecurity ?
Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Configure proper network segmentation, Collaboration with cybersecurity agencies (e.g., CSE, CISA, NCSC) for threat intelligence sharing., Disable unnecessary services, Enhanced monitoring for signs of compromise, especially in legacy systems., Prioritize security updates for VPN and remote access infrastructure., Implement strict firewall rules, Apply the patches as directed in the vendor's bulletin., Users should patch immediately., Organizations should prioritize updating affected systems immediately., Update to the latest firmware versions, Immediate patching of Cisco ASA vulnerabilities as per vendor and cyber agency guidelines., Review and update incident response plans for state-sponsored APTs., Organizations should disable the Out-of-Band AP Image Download feature and apply software updates., Implement multi-factor authentication (MFA), Monitor for suspicious activities in SIEM systems, Regularly audit user accounts with administrative privileges and Verify ISE versions and apply necessary patches.
References
Where can I find more information about each incident ?
Incident : Ransomware CIS0217922
Source: BleepingComputer
Incident : Vulnerability Exploitation CIS958072325
Source: Cisco Security Advisory
Date Accessed: 2025-07-01
Incident : Data Breach CIS747072825
Source: California Office of the Attorney General
Date Accessed: 2016-10-25
Incident : Remote Code Execution CIS905072925
Source: zerodayinitiative.com
Incident : Vulnerability Disclosure CIS751081525
Source: Cisco Security Advisory: CVE-2025-20265
Date Accessed: August 2025
Incident : Vulnerability Disclosure CIS751081525
Source: Cisco August 2025 Semiannual Security Advisory Bundled Publication
URL: https://sec.cloudapps.cisco.com/security/center/publicationListing.x
Date Accessed: August 2025
Incident : Vulnerability Exploitation CIS834081625
Source: Cisco Security Advisory
Incident : Zero-day Exploitation CIS2892128092425
Source: Cisco PSIRT Advisory
Incident : Zero-day exploitation CIS5262052092625
Source: U.K. National Cyber Security Centre (NCSC)
Date Accessed: 2025-09-25
Incident : Zero-day exploitation CIS5262052092625
Source: Cisco Security Advisory
Date Accessed: 2025-09
Incident : Zero-day exploitation CIS5262052092625
Source: Canadian Centre for Cyber Security Advisory
Date Accessed: 2025-09
Incident : Espionage CIS5802058092725
Source: CBC News
URL: https://www.cbc.ca/news/politics/cisco-cyberattack-cse-warning-1.7240000
Date Accessed: 2024-06-20
Incident : Espionage CIS5802058092725
Source: U.S. Cybersecurity and Infrastructure Security Agency (CISA) Emergency Directive
URL: https://www.cisa.gov/news-events/directives
Date Accessed: 2024-06-20
Incident : Espionage CIS5802058092725
Source: Canadian Centre for Cyber Security (CSE) Advisory
URL: https://cyber.gc.ca/en/guidance
Date Accessed: 2024-06-20
Incident : Espionage CIS5802058092725
Source: UK National Cyber Security Centre (NCSC) Warning
URL: https://www.ncsc.gov.uk/news
Date Accessed: 2024-06-20
Incident : Espionage CIS5802058092725
Source: Cisco Security Advisory (ArcaneDoor)
Date Accessed: 2024-06-20
Incident : Cyberattack CIS2032020092825
Source: Wired
Incident : Cyberattack CIS2032020092825
Source: CISA Directive (September 25, 2025)
Date Accessed: 2025-09-25
Incident : Vulnerability Exploitation CIS0692106093025
Source: Cisco Security Advisory (CVE-2025-20333)
URL: [1]
Date Accessed: 2024-09-25
Incident : Vulnerability Exploitation CIS0692106093025
Source: Cisco Security Advisory (CVE-2025-20362)
URL: [2]
Date Accessed: 2024-09-25
Incident : Vulnerability Exploitation CIS0692106093025
Source: The Shadowserver Foundation - Vulnerable Cisco ASA/FTD Scan Report
Date Accessed: 2024-09-29
Incident : Vulnerability Exploitation CIS0692106093025
Source: CISA Emergency Directive on Cisco ASA/FTD Vulnerabilities
Date Accessed: 2024-09-25
Incident : Vulnerability Exploitation CIS0692106093025
Source: UK NCSC Threat Report on Line Viper and RayInitiator Malware
Date Accessed: 2024-09-29
Incident : Vulnerability Exploitation CIS0692106093025
Source: Greynoise - Early Warning on Cisco ASA Scans
Date Accessed: 2024-09-04
Incident : Ransomware CIS0702107111125
Source: U.S. Department of Justice (Court Documents)
Date Accessed: 2025-10-29
Incident : Ransomware CIS0702107111125
Source: Seamus Hughes (Reporter, Unsealed Documents)
Incident : Ransomware CIS0702107111125
Source: Symantec (Yanluowang Discovery, 2021)
Date Accessed: 2021-10
Incident : Ransomware CIS0702107111125
Source: Kaspersky (Decrypter Release, 2022)
Date Accessed: 2022
Incident : Ransomware CIS0702107111125
Source: FBI Investigation (Cryptocurrency Tracing)
Incident : ransomware CIS2802228111125
Source: Court Watch (Seamus Hughes)
Incident : ransomware CIS2802228111125
Source: FBI affidavit (Special Agent Jeffrey Hunter)
Incident : ransomware CIS2802228111125
Source: Blockchain analysis (ransom payments)
Incident : Vulnerability CIS4992749111425
Source: Cisco Security Advisory
Where can stakeholders find additional resources on cybersecurity best practices ?
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: BleepingComputer, and Source: Cisco DisclosureDate Accessed: 2025-05-07, and Source: Cisco Security AdvisoryDate Accessed: 2025-07-01, and Source: California Office of the Attorney GeneralDate Accessed: 2016-10-25, and Source: zerodayinitiative.comUrl: https://www.zerodayinitiative.com, and Source: Cisco Security Advisory: CVE-2025-20265Url: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-KLJ98X7QDate Accessed: August 2025, and Source: Cisco August 2025 Semiannual Security Advisory Bundled PublicationUrl: https://sec.cloudapps.cisco.com/security/center/publicationListing.xDate Accessed: August 2025, and Source: Cisco Security Advisory, and Source: Cisco PSIRT Advisory, and Source: U.K. National Cyber Security Centre (NCSC)Date Accessed: 2025-09-25, and Source: Cisco Security AdvisoryDate Accessed: 2025-09, and Source: Canadian Centre for Cyber Security AdvisoryDate Accessed: 2025-09, and Source: CBC NewsUrl: https://www.cbc.ca/news/politics/cisco-cyberattack-cse-warning-1.7240000Date Accessed: 2024-06-20, and Source: U.S. Cybersecurity and Infrastructure Security Agency (CISA) Emergency DirectiveUrl: https://www.cisa.gov/news-events/directivesDate Accessed: 2024-06-20, and Source: Canadian Centre for Cyber Security (CSE) AdvisoryUrl: https://cyber.gc.ca/en/guidanceDate Accessed: 2024-06-20, and Source: UK National Cyber Security Centre (NCSC) WarningUrl: https://www.ncsc.gov.uk/newsDate Accessed: 2024-06-20, and Source: Cisco Security Advisory (ArcaneDoor)Url: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-arcane-door-2024Date Accessed: 2024-06-20, and Source: BloombergDate Accessed: 2025-09-28, and Source: Wired, and Source: CISA Directive (September 25, 2025)Date Accessed: 2025-09-25, and Source: Cisco Security Advisory (CVE-2025-20333)Url: [1]Date Accessed: 2024-09-25, and Source: Cisco Security Advisory (CVE-2025-20362)Url: [2]Date Accessed: 2024-09-25, and Source: The Shadowserver Foundation - Vulnerable Cisco ASA/FTD Scan ReportDate Accessed: 2024-09-29, and Source: CISA Emergency Directive on Cisco ASA/FTD VulnerabilitiesDate Accessed: 2024-09-25, and Source: UK NCSC Threat Report on Line Viper and RayInitiator MalwareDate Accessed: 2024-09-29, and Source: Greynoise - Early Warning on Cisco ASA ScansDate Accessed: 2024-09-04, and Source: U.S. Department of Justice (Court Documents)Date Accessed: 2025-10-29, and Source: Seamus Hughes (Reporter, Unsealed Documents), and Source: Symantec (Yanluowang Discovery, 2021)Date Accessed: 2021-10, and Source: Kaspersky (Decrypter Release, 2022)Date Accessed: 2022, and Source: FBI Investigation (Cryptocurrency Tracing), and Source: Court Watch (Seamus Hughes), and Source: FBI affidavit (Special Agent Jeffrey Hunter), and Source: Blockchain analysis (ransom payments), and Source: Cisco Security Advisory.
Investigation Status
What is the current status of the investigation for each incident ?
Incident : Vulnerability Exploitation CIS958072325
Investigation Status: Ongoing monitoring for exploitation attempts
Incident : Vulnerability Disclosure CIS751081525
Investigation Status: Disclosed; No public exploitation reported. Internal discovery by Cisco.
Incident : Vulnerability Exploitation CIS834081625
Investigation Status: Vulnerability disclosed; patch available
Incident : Zero-day Exploitation CIS2892128092425
Investigation Status: Ongoing (exploitation confirmed in the wild)
Incident : Zero-day exploitation CIS5262052092625
Investigation Status: Ongoing (as of 2025-09-25)
Incident : Espionage CIS5802058092725
Investigation Status: Ongoing (CSE and international allies investigating scope and attribution)
Incident : Cyberattack CIS2032020092825
Investigation Status: Ongoing (CISA and Cisco involved)
Incident : Vulnerability Exploitation CIS0692106093025
Investigation Status: Ongoing (Active Exploitation Confirmed; Patching Underway)
Incident : Ransomware CIS0702107111125
Investigation Status: Ongoing (Plea deal signed 2025-11-25; sentencing pending)
Incident : ransomware CIS2802228111125
Investigation Status: ongoing (legal proceedings active, defendant pleaded guilty)
Incident : Vulnerability CIS4992749111425
Investigation Status: Internally discovered (via TAC support case); no evidence of exploitation in the wild.
How does the company communicate the status of incident investigations to stakeholders ?
Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Public advisory and urgent calls for patching, Public Advisory Via Cisco’S August 2025 Semiannual Security Advisory Bundled Publication, Urgent Recommendation For Immediate Patching, Public Security Advisory Released By Cisco, Public Advisory Via Cisco Psirt, Recommendation For Immediate Patching, Public Advisories By Ncsc (2025-09-25), Cisco Security Bulletins, Canadian Centre For Cyber Security Alerts, Public Warnings By Cse (Canada), Cisa (U.S.), Ncsc (Uk), Media Statements (E.G., Cbc News), Collaboration With Five Eyes Alliance, Public Disclosure Via Bloomberg, Cisa Advisories, Cisco Security Advisories [1, 2], Cisa Emergency Directive, Ncsc Threat Report, Public Security Advisory and Direct Customer Notifications Via Tac.
Stakeholder and Customer Advisories
Were there any advisories issued to stakeholders or customers for each incident ?
Incident : Vulnerability Disclosure CIS751081525
Stakeholder Advisories: Urgent Patching Recommended For All Affected Organizations..
Customer Advisories: Customers using Cisco Secure FMC with RADIUS enabled should apply updates or disable RADIUS immediately.
Incident : Vulnerability Exploitation CIS834081625
Stakeholder Advisories: Cisco Customers Using Fmc With Radius Authentication.
Customer Advisories: Public security advisory with patch instructions
Incident : Zero-day Exploitation CIS2892128092425
Stakeholder Advisories: Cisco Psirt Advisory With Patching Guidance.
Customer Advisories: Urgent recommendation to apply patches or mitigate SNMP access
Incident : Zero-day exploitation CIS5262052092625
Stakeholder Advisories: Urgent Patching Recommended For All Affected Organizations, Government Agencies Advised To Audit Asa Devices.
Customer Advisories: Cisco PSIRT notificationsPublic security bulletins
Incident : Espionage CIS5802058092725
Stakeholder Advisories: Urgent Patching Directives For Federal Agencies (U.S.), Public Warnings For Critical Infrastructure Sectors (Canada, Uk, Five Eyes).
Customer Advisories: Cisco customer notifications (via security advisory)Guidance for organizations using Cisco ASA for VPNs
Incident : Cyberattack CIS2032020092825
Stakeholder Advisories: Cisa Directives To Federal Agencies, Public Statements By Chris Butera (Cisa).
Incident : Vulnerability Exploitation CIS0692106093025
Stakeholder Advisories: Cisco Customers, Federal Civilian Executive Branch (Fceb) Agencies, Global Organizations Using Cisco Asa/Ftd.
Customer Advisories: Apply Patches ImmediatelyMonitor for Indicators of Compromise (IoCs)Review VPN Access Logs for Unauthorized Activity
Incident : Vulnerability CIS4992749111425
Stakeholder Advisories: Cisco Psirt Advisory With Fixed Software Details.
Customer Advisories: Urgent upgrade notice for affected versions
What advisories does the company provide to stakeholders and customers following an incident ?
Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Urgent Patching Recommended For All Affected Organizations., Customers Using Cisco Secure Fmc With Radius Enabled Should Apply Updates Or Disable Radius Immediately., , Cisco Customers Using Fmc With Radius Authentication, Public Security Advisory With Patch Instructions, , Cisco Psirt Advisory With Patching Guidance, Urgent Recommendation To Apply Patches Or Mitigate Snmp Access, , Urgent Patching Recommended For All Affected Organizations, Government Agencies Advised To Audit Asa Devices, Cisco Psirt Notifications, Public Security Bulletins, , Urgent Patching Directives For Federal Agencies (U.S.), Public Warnings For Critical Infrastructure Sectors (Canada, Uk, Five Eyes), Cisco Customer Notifications (Via Security Advisory), Guidance For Organizations Using Cisco Asa For Vpns, , Cisa Directives To Federal Agencies, Public Statements By Chris Butera (Cisa), Cisco Customers, Federal Civilian Executive Branch (Fceb) Agencies, Global Organizations Using Cisco Asa/Ftd, Apply Patches Immediately, Monitor For Indicators Of Compromise (Iocs), Review Vpn Access Logs For Unauthorized Activity, , Cisco Psirt Advisory With Fixed Software Details, Urgent Upgrade Notice For Affected Versions and .
Initial Access Broker
How did the initial access broker gain entry for each incident ?
Incident : Data Breach CIS193201022
Entry Point: Personal Google Account
Incident : Unauthorized Access CIS205918123
Entry Point: Amazon Web Services
Incident : Ransomware Attack CIS311050624
Entry Point: Compromised personal Google account
Incident : Advanced Persistent Threat (APT) CIS000082424
Entry Point: Cisco switches
Backdoors Established: VELVETSHELL malware
Incident : Vulnerability Exploitation CIS929041225
Entry Point: Smart Install Feature
High Value Targets: Telecommunications Providers
Data Sold on Dark Web: Telecommunications Providers
Incident : Software Vulnerability CIS719053025
Entry Point: /aparchive/upload and /ap_spec_rec/upload/
Backdoors Established: Hard-coded JWT secret 'notfound'
High Value Targets: Enterprise-grade wireless controllers
Data Sold on Dark Web: Enterprise-grade wireless controllers
Incident : Remote Access Vulnerability CIS356070325
Entry Point: Hardcoded SSH credentials
Incident : Vulnerability Exploitation CIS958072325
Entry Point: Crafted API requests
High Value Targets: Cisco ISE and ISE-PIC deployments
Data Sold on Dark Web: Cisco ISE and ISE-PIC deployments
Incident : Vulnerability Exploitation CIS834081625
Entry Point: Radius Authentication Interface In Fmc,
High Value Targets: Firewall Management Credentials, Network Infrastructure Control,
Data Sold on Dark Web: Firewall Management Credentials, Network Infrastructure Control,
Incident : Zero-day Exploitation CIS2892128092425
Entry Point: Compromised Local Administrator Credentials,
Incident : Zero-day exploitation CIS5262052092625
Entry Point: Cve-2025-20362 And Cve-2025-20333 In Cisco Asa Vpn Web Services,
Backdoors Established: ['RayInitiator (GRUB bootkit)', 'LINE VIPER (shellcode loader)', 'ROMMON modifications']
High Value Targets: Government Agencies, Vpn Authentication Systems, Cli Command History,
Data Sold on Dark Web: Government Agencies, Vpn Authentication Systems, Cli Command History,
Incident : Espionage CIS5802058092725
Entry Point: Vulnerabilities In Cisco Asa Devices (Legacy Systems Targeted),
Backdoors Established: Likely (malware implantation and command execution capabilities)
High Value Targets: Critical Infrastructure Sectors, Government, Academia, And Research Facilities,
Data Sold on Dark Web: Critical Infrastructure Sectors, Government, Academia, And Research Facilities,
Incident : Cyberattack CIS2032020092825
Entry Point: Cisco Asa/Ftd Vulnerabilities (Cve-2024-20353, Cve-2024-20359),
Reconnaissance Period: Since 2024 (ArcaneDoor group activity)
High Value Targets: U.S. Federal Cyber Infrastructure, Classified Government Documents,
Data Sold on Dark Web: U.S. Federal Cyber Infrastructure, Classified Government Documents,
Incident : Vulnerability Exploitation CIS0692106093025
Entry Point: Exposed Vpn Web Interfaces, Crafted Http Requests Targeting Cve-2025-20333/Cve-2025-20362,
Reconnaissance Period: Late August 2024 (Greynoise Scans)
Backdoors Established: ['Line Viper (Shellcode Loader)', 'RayInitiator (GRUB Bootkit)']
High Value Targets: Federal Agencies (Fceb), Critical Infrastructure, Enterprises With Sensitive Data,
Data Sold on Dark Web: Federal Agencies (Fceb), Critical Infrastructure, Enterprises With Sensitive Data,
Incident : Ransomware CIS0702107111125
Entry Point: Exploited Vulnerabilities (Unspecified), Potential Phishing,
Reconnaissance Period: July 2021 – November 2022
Backdoors Established: True
High Value Targets: Banks, Telecoms, Engineering Firms, Cisco, Walmart,
Data Sold on Dark Web: Banks, Telecoms, Engineering Firms, Cisco, Walmart,
Incident : ransomware CIS2802228111125
Entry Point: Corporate Network Breaches (Method Unspecified),
Backdoors Established: True
High Value Targets: U.S. Companies (8+), Cisco (Attempted),
Data Sold on Dark Web: U.S. Companies (8+), Cisco (Attempted),
Post-Incident Analysis
What were the root causes and corrective actions taken for each incident ?
Incident : Data Breach CIS193201022
Root Causes: Credential Compromise via Voice Phishing
Incident : Data Leak CIS1221121123
Root Causes: Erroneous Security Configuration
Incident : Advanced Persistent Threat (APT) CIS000082424
Root Causes: Zero-day vulnerability CVE-2024-20399
Incident : Security Vulnerabilities SPL355032725
Root Causes: Remote Code Execution (Rce) Through Malicious File Uploads, Unauthorized Disclosure Of Sensitive Information Through Privilege Escalation,
Corrective Actions: Patches And Updates Provided To Users,
Incident : Vulnerability Exploitation CIS929041225
Root Causes: Unpatched Systems
Incident : Vulnerability Exploitation CIS221051225
Root Causes: Hardcoded tokens
Corrective Actions: Patching
Incident : Software Vulnerability CIS719053025
Root Causes: Hard-coded JWT present in the Out-of-Band Access Point (AP) Image Download feature
Corrective Actions: Software updates and disabling vulnerable features
Incident : Privilege Escalation CIS616060625
Root Causes: Improper Input Validation, Insufficient Access Controls, Inadequate Session Validation, Jwt Manipulation, Session Hijacking,
Corrective Actions: Update To The Latest Firmware Versions, Configure Proper Network Segmentation, Implement Multi-Factor Authentication (Mfa), Disable Unnecessary Services, Implement Strict Firewall Rules, Regularly Audit User Accounts With Administrative Privileges, Monitor For Suspicious Activities In Siem Systems,
Incident : Remote Access Vulnerability CIS356070325
Root Causes: Hardcoded SSH credentials left in the system during development phases
Corrective Actions: Apply Patch Ciscocm.Cscwp27755 D0247-1.Cop.Sha512, Upgrade To 15Su3 Release,
Incident : Vulnerability CIS606071825
Root Causes: Insufficient User-Supplied Input Validation Checks,
Corrective Actions: Apply Patches For Cve-2025-20337,
Incident : Vulnerability Exploitation CIS958072325
Root Causes: Insufficient validation of user-supplied input in specific APIs
Corrective Actions: Apply patches and enhanced fixed releases
Incident : Remote Code Execution CIS905072925
Root Causes: Unsafe deserialization and command injection in the enableStrongSwanTunnel() method.
Corrective Actions: Update to 3.3 Patch 7 and 3.4 Patch 2
Incident : Vulnerability Disclosure CIS751081525
Root Causes: Insufficient Input Validation In Radius Authentication Subsystem., Improper Handling Of User-Supplied Credentials During Authentication.,
Corrective Actions: Released Patched Software Versions., Recommended Disabling Radius Authentication As A Temporary Mitigation.,
Incident : Vulnerability Exploitation CIS834081625
Root Causes: Improper Input Validation During Radius Authentication, Lack Of Sufficient Privilege Separation In Authentication Flow,
Corrective Actions: Software Patch To Fix Input Handling, Enhanced Authentication Validation Mechanisms,
Incident : Zero-day Exploitation CIS2892128092425
Root Causes: Stack-Based Buffer Overflow In Snmp Subsystem, Insufficient Input Validation For Snmp Packets,
Corrective Actions: Patch Deployment (Cve-2025-20352, Others), Snmp Access Restrictions,
Incident : Zero-day exploitation CIS5262052092625
Root Causes: Exploitation Of Unpatched Zero-Day Vulnerabilities In Legacy Devices, Lack Of Secure Boot/Trust Anchor On Asa 5500-X Series, Use Of End-Of-Support Hardware In Critical Infrastructure, Insufficient Logging/Monitoring For Advanced Evasion Techniques,
Corrective Actions: Accelerated Eos Timelines For Vulnerable Devices, Enhanced Firmware Integrity Checks In Asa Software, Improved Detection For Bootkit-Level Persistence, Collaboration With Ncsc/Cccs For Threat Intelligence Sharing,
Incident : Espionage CIS5802058092725
Root Causes: Exploitation Of Unpatched Vulnerabilities In Cisco Asa, Targeting Of Legacy Systems, State-Sponsored Actor Sophistication,
Incident : Cyberattack CIS2032020092825
Root Causes: Unpatched Zero-Day Vulnerabilities In Cisco Devices, Insufficient Monitoring Of High-Value Targets,
Corrective Actions: Mandatory Vulnerability Assessments (Cisa Directive), Patch Management Enforcement,
Incident : Vulnerability Exploitation CIS0692106093025
Root Causes: Delayed Patching Of Zero-Day Vulnerabilities, Over-Exposure Of Vpn Interfaces To The Public Internet, Lack Of Temporary Mitigations (No Workarounds Available), Insufficient Monitoring For Early Indicators Of Exploitation,
Corrective Actions: Mandatory Patching Enforcement (E.G., Cisa Directive), Network Segmentation For Vpn Access Points, Enhanced Threat Detection For Malware (Line Viper, Rayinitiator), Accelerated End-Of-Support (Eos) Device Replacement,
Incident : Ransomware CIS0702107111125
Root Causes: Insufficient Network Segmentation Allowing Lateral Movement Post-Initial Access., Lack Of Detection For Initial Access Brokerage Activity., Vulnerabilities In Yanluowang’S Encryption Algorithm (Later Exploited By Kaspersky For Decrypter)., Use Of Cryptocurrency For Ransom Payments Enabling Anonymity.,
Corrective Actions: Fbi Disruption Of Yanluowang Operations Via Arrest/Extradition Of Volkov., Kaspersky’S Public Release Of A Free Decrypter (2022)., Heightened Scrutiny Of Russian-Linked Threat Actors Masquerading As Other Nationalities., Emphasis On Tracing Cryptocurrency Transactions For Attribution.,
Incident : ransomware CIS2802228111125
Root Causes: Initial Access Brokerage Enabling Ransomware Deployment, Credential Theft/Exploitation, Potential Vulnerabilities In Corporate Networks,
Incident : Vulnerability CIS4992749111425
Root Causes: Insufficient Validation Of User-Supplied Input In Http Requests,
Corrective Actions: Software Patch (Input Validation Fixes) Released In Versions 2.3.7.10-Va And Later,
What is the company's process for conducting post-incident analysis ?
Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Monitor for suspicious activities in SIEM systems, Monitor system logs for unauthorized root access, Recommended: Monitor For Unauthorized Access Attempts Targeting Fmc Interfaces, , U.K. National Cyber Security Centre (Ncsc), Canadian Centre For Cyber Security, , Recommended For Asa/Ftd Devices, , Five Eyes Intelligence Alliance, Cisco Internal Teams, , Recommended (implied by urgency of patching and detection evasion concerns), Cisco Cybersecurity Experts, , Use Of Cisa Cybersecurity Tools For Threat Assessment, , The Shadowserver Foundation (Threat Monitoring), Greynoise (Early Warning Scans), , Monitor For Crafted Http Requests, Track Suspicious Vpn Logins, , Fbi Investigation, Symantec (Threat Intelligence), Kaspersky (Decryption Tool), , Fbi, International Law Enforcement (Italy), .
What corrective actions has the company taken based on post-incident analysis ?
Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Patches And Updates Provided To Users, , Patching, Software updates and disabling vulnerable features, Update To The Latest Firmware Versions, Configure Proper Network Segmentation, Implement Multi-Factor Authentication (Mfa), Disable Unnecessary Services, Implement Strict Firewall Rules, Regularly Audit User Accounts With Administrative Privileges, Monitor For Suspicious Activities In Siem Systems, , Apply Patch Ciscocm.Cscwp27755 D0247-1.Cop.Sha512, Upgrade To 15Su3 Release, , Apply Patches For Cve-2025-20337, , Apply patches and enhanced fixed releases, Update to 3.3 Patch 7 and 3.4 Patch 2, Released Patched Software Versions., Recommended Disabling Radius Authentication As A Temporary Mitigation., , Software Patch To Fix Input Handling, Enhanced Authentication Validation Mechanisms, , Patch Deployment (Cve-2025-20352, Others), Snmp Access Restrictions, , Accelerated Eos Timelines For Vulnerable Devices, Enhanced Firmware Integrity Checks In Asa Software, Improved Detection For Bootkit-Level Persistence, Collaboration With Ncsc/Cccs For Threat Intelligence Sharing, , Mandatory Vulnerability Assessments (Cisa Directive), Patch Management Enforcement, , Mandatory Patching Enforcement (E.G., Cisa Directive), Network Segmentation For Vpn Access Points, Enhanced Threat Detection For Malware (Line Viper, Rayinitiator), Accelerated End-Of-Support (Eos) Device Replacement, , Fbi Disruption Of Yanluowang Operations Via Arrest/Extradition Of Volkov., Kaspersky’S Public Release Of A Free Decrypter (2022)., Heightened Scrutiny Of Russian-Linked Threat Actors Masquerading As Other Nationalities., Emphasis On Tracing Cryptocurrency Transactions For Attribution., , Software Patch (Input Validation Fixes) Released In Versions 2.3.7.10-Va And Later, .
Additional Questions
General Information
Has the company ever paid ransoms ?
Ransom Payment History: The company has Paid ransoms in the past.
What was the amount of the last ransom demanded ?
Last Ransom Demanded: The amount of the last ransom demanded was $1.5M+ (confirmed from two victims).
Who was the attacking group in the last incident ?
Last Attacking Group: The attacking group in the last incident were an Yanluowang ransomware gang, Unknown, Yanluowang Ransomware Gang, Sudhish Kasaba Ramesh, Yanluowang, Velvet Ant, Salt Typhoon, ArcaneDoorUAT4356Storm-1849Suspected China-linked state-sponsored group, State-sponsored actor (high confidence; linked to ArcaneDoor campaign), ArcaneDoor Hacker GroupRussian Hackers (for federal courts breach), Name: Aleksey Olegovich Volkov (aka 'chubaka.kor')Affiliation: ['Yanluowang Ransomware Gang', 'LockBit Ransomware Gang (alleged communication)']Nationality: RussianRole: Initial Access BrokerAliases: ['chubaka.kor', 'Alekseq Olegovi3 Volkov']Birthdate: 2000-03-20Cryptocurrency Wallets: ['Linked to Russian passport-verified account']Email: [email protected] Id: [email protected], Name: Aleksey Olegovich VolkovAliases: ['chubaka.kor', 'nets', '[email protected]', '[email protected]']Affiliation: ['Yanluowang ransomware group', 'potential link to LockBit ransomware gang']Nationality: RussianStatus: arrested (January 2024), extradited to U.S., pleaded guilty (October 29 and 2024).
Incident Details
What was the most recent incident detected ?
Most Recent Incident Detected: The most recent incident detected was on 2018-09-24.
What was the most recent incident publicly disclosed ?
Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2024-10-29.
What was the most recent incident resolved ?
Most Recent Incident Resolved: The most recent incident resolved was on 2025-07-22.
Impact of the Incidents
What was the highest financial loss from an incident ?
Highest Financial Loss: The highest financial loss from an incident was $2,400,000.
What was the most significant data compromised in an incident ?
Most Significant Data Compromised: The most significant data compromised in an incident were Cisco products or services, Sensitive customer data, Sensitive employee information, Intellectual property, Supply chain operations, , 3,176 files, 2,875,897,023 bytes in 2111 Directories, , non-sensitive files, classified documents, technical schematics, source code, , name, password, email address, phone number, security question answers, professional profile, educational background, cover letter, resume content, , Sensitive Information, Sensitive Data, names, addresses, emails, phone numbers, other sensitive data, , Potential exfiltration from government agencies, VPN credentials (via AAA bypass), CLI commands (harvested), Packet captures, , Classified documents (espionage, fraud, money laundering, foreign agent activities), and .
What was the most significant system affected in an incident ?
Most Significant System Affected: The most significant system affected in an incident were Cisco Small Business RV Series routers and 16,000 WebEx Teams accounts456 virtual machines and and and Splunk EnterpriseSplunk Cloud PlatformSplunk Secure Gateway app and and and Catalyst 9800-CL Wireless Controllers for CloudCatalyst 9800 series controllers and Catalyst 9800-CL Wireless Controllers for CloudCatalyst 9800 Embedded Wireless Controllers for Catalyst 9300/9400/9500 Series SwitchesCatalyst 9800 Series Wireless ControllersEmbedded Wireless Controller on Catalyst APs and Cisco UCS C-SeriesCisco UCS S-Series and Cisco Unified Communications ManagerCisco Unified Communications Manager Session Management Edition and Cisco ISE and ISE-PIC versions 3.4 and 3.3 and and Cisco Professional Careers mobile website and and Cisco Secure Firewall Management Center (FMC) Software (versions 7.0.7, 7.7.0 with RADIUS enabled) and Cisco Secure Firewall Management Center (FMC) Software (versions 7.0.7, 7.7.0) and Cisco devices running vulnerable IOS/IOS XE Software with SNMP enabled and Cisco ASA 5500-X Series (5512-X, 5515-X, 5525-X, 5545-X, 5555-X, 5585-X)Devices running Cisco ASA Software 9.12 or 9.14 with VPN web services enabled and Cisco Adaptive Security Appliances (ASA)VPN-enabled systems used by remote workers and Cisco Adaptive Security Appliance (ASA)Firepower Threat Defense (FTD) softwareHundreds of Cisco firewall devicesU.S. federal courts computer systems and and and Cisco Catalyst Center Virtual Appliances on VMware ESXi (versions 2.3.7.3-VA and later, excluding 3.1+).
Response to the Incidents
What third-party assistance was involved in the most recent incident ?
Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was u.k. national cyber security centre (ncsc), canadian centre for cyber security, , five eyes intelligence alliance, cisco internal teams, , cisco cybersecurity experts, , the shadowserver foundation (threat monitoring), greynoise (early warning scans), , fbi investigation, symantec (threat intelligence), kaspersky (decryption tool), , fbi, international law enforcement (italy), .
What containment measures were taken in the most recent incident ?
Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were Took action to contain and eradicate the bad actors, Disable the Out-of-Band AP Image Download feature, Network segmentationMulti-factor authentication (MFA)Disable unnecessary servicesImplement strict firewall rulesRegular auditing of administrative accounts, Apply patch ciscocm.CSCwp27755_D0247-1.cop.sha512Upgrade to 15SU3 release, Immediate patching, Apply security updates, Disable RADIUS authentication (switch to LDAP/SAML/local accounts), Urgent patching advisory issued by Cisco, Limiting SNMP access to trusted users (temporary mitigation), Cisco patches for CVE-2025-20362, CVE-2025-20333, CVE-2025-20363Urgent advisories for updatesDisabling VPN web services on vulnerable devices, Urgent Patching of Cisco ASA VulnerabilitiesEmergency Directives (e.g., U.S. CISA's midnight deadline for federal agencies), CISA directive to identify affected devicesData collection and threat assessment using CISA tools, Restrict VPN Web Interface ExposureDisconnect End-of-Support (EoS) ASA DevicesIncrease Logging/Monitoring for Suspicious VPN Logins, Immediate software upgrade to patched versions (e.g. and 2.3.7.10-VA).
Data Breach Information
What was the most sensitive data compromised in a breach ?
Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Sensitive Data, cover letter, VPN credentials (via AAA bypass), CLI commands (harvested), professional profile, 2,875,897,023 bytes in 2111 Directories, Sensitive Information, classified documents, addresses, name, security question answers, emails, source code, Supply chain operations, password, other sensitive data, Potential exfiltration from government agencies, Packet captures, non-sensitive files, technical schematics, email address, resume content, Cisco products or services, Sensitive customer data, educational background, Sensitive employee information, Classified documents (espionage, fraud, money laundering, foreign agent activities), phone numbers, 3,176 files, phone number, Intellectual property and names.
Ransomware Information
Regulatory Compliance
What was the most significant legal action taken for a regulatory violation ?
Most Significant Legal Action: The most significant legal action taken for a regulatory violation was U.S. Federal Charges (hacking, theft, extortion), Plea Deal (2025-10-29), Extradition from Italy (2023), , arrest (Italy, January 2024), extradition to U.S., guilty plea (October 29, 2024), charges: unlawful transfer of means of identification, trafficking in access information, access device fraud, aggravated identity theft, conspiracy to commit computer fraud, conspiracy to commit money laundering, .
Lessons Learned and Recommendations
What was the most significant lesson learned from past incidents ?
Most Significant Lesson Learned: The most significant lesson learned from past incidents was Observer-level accounts can serve as attack vectors; least-privilege principles must be enforced.
What was the most significant recommendation implemented to improve cybersecurity ?
Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Monitor for signs of exploitation (e.g., unexpected SNMP traffic, DoS symptoms), Implement strict firewall rules, Monitor dark web forums for initial access brokerage activity targeting your industry., Upgrade affected Cisco Catalyst Center Virtual Appliances to version 2.3.7.10-VA or later immediately., Implement multi-factor authentication (MFA) and least-privilege access to thwart initial access brokers., Organizations should disable the Out-of-Band AP Image Download feature and apply software updates., Upgrade to fixed software releases immediately, Immediately patch affected Cisco Secure FMC Software (versions 7.0.7, 7.7.0) to the latest release., Enable multi-factor authentication for FMC access where possible, Configure proper network segmentation, Prioritize this vulnerability as a 'priority-one' patching scenario due to its critical severity (CVSS 10.0) and potential for unauthenticated remote code execution., Monitor authentication logs for anomalous activity, Apply the patches as directed in the vendor's bulletin., Users should patch immediately., Organizations should prioritize updating affected systems immediately., Implement network segmentation for firewall management interfaces, Enable Secure Boot and Trust Anchor on supported devices, Deploy Enhanced Monitoring for Suspicious HTTP Requests and VPN Logins, Audit user roles to minimize Observer-level access where unnecessary., Conduct forensic analysis of ASA firmware for signs of RayInitiator/LINE VIPER, Review Administrator credential security post-compromise, Disable RADIUS authentication if patching is not immediately feasible, and switch to LDAP, SAML SSO, or local accounts., Verify ISE versions and apply necessary patches, Review and harden RADIUS authentication configurations, Disable VPN web services if not essential, Follow CISA and NCSC Guidelines for Hardening Network Perimeters, Leverage threat intelligence sharing to identify emerging ransomware strains like Yanluowang., Disable unnecessary services, Prioritize security updates for VPN and remote access infrastructure., Immediately Patch CVE-2025-20333 and CVE-2025-20362 on All Cisco ASA/FTD Devices, Conduct Threat Hunting for 'Line Viper' and 'RayInitiator' Malware, Subscribe to vendor security advisories (e.g., Cisco PSIRT) for real-time alerts., Deploy network segmentation to limit lateral movement, Monitor for unusual CLI command activity or syslog suppression, Immediately patch CVE-2025-20362, CVE-2025-20333, and CVE-2025-20363, Monitor for unusual authentication attempts or command execution on FMC systems until patches are applied., Immediate patching of Cisco ASA vulnerabilities as per vendor and cyber agency guidelines., Prepare for double-extortion tactics (data encryption + exfiltration) in ransomware response plans., Monitor for suspicious activities in SIEM systems, Ensure devices have enough memory before upgrading, Immediately apply Cisco's patch for affected FMC versions (7.0.7, 7.7.0), Limit SNMP access to trusted users if patching is delayed, Collaboration with cybersecurity agencies (e.g., CSE, CISA, NCSC) for threat intelligence sharing., Enhanced monitoring for signs of compromise, especially in legacy systems., Implement behavioral detection for ICMP/TCP and WebVPN C2 traffic, Disconnect End-of-Support (EoS) Devices from Networks, Regularly audit cryptocurrency transactions for signs of ransomware payments., System administrators should take immediate action to mitigate risks, Update to the latest firmware versions, Review and update incident response plans for state-sponsored APTs., Implement multi-factor authentication (MFA), Test and confirm current configurations for hardware and software components, Restrict Public Exposure of VPN Web Interfaces, Monitor for unusual privilege escalation attempts or unauthorized account creation., Replace end-of-support Cisco ASA 5500-X Series devices, Regularly audit user accounts with administrative privileges and Conduct a review of all authentication mechanisms in enterprise firewall infrastructure to identify similar input validation risks..
References
What is the most recent source of information about an incident ?
Most Recent Source: The most recent source of information about an incident are FBI Investigation (Cryptocurrency Tracing), Canadian Centre for Cyber Security (CSE) Advisory, BleepingComputer, Cisco Security Advisory, Canadian Centre for Cyber Security Advisory, U.S. Department of Justice (Court Documents), UK NCSC Threat Report on Line Viper and RayInitiator Malware, Cisco Security Advisory (CVE-2025-20362), Greynoise - Early Warning on Cisco ASA Scans, Cisco PSIRT Advisory, CISA Emergency Directive on Cisco ASA/FTD Vulnerabilities, UK National Cyber Security Centre (NCSC) Warning, CBC News, Symantec (Yanluowang Discovery, 2021), Cisco Security Advisory: CVE-2025-20265, Cisco Security Advisory (ArcaneDoor), FBI affidavit (Special Agent Jeffrey Hunter), Blockchain analysis (ransom payments), Court Watch (Seamus Hughes), Kaspersky (Decrypter Release, 2022), Bloomberg, Seamus Hughes (Reporter, Unsealed Documents), U.K. National Cyber Security Centre (NCSC), zerodayinitiative.com, Cisco Disclosure, U.S. Cybersecurity and Infrastructure Security Agency (CISA) Emergency Directive, The Shadowserver Foundation - Vulnerable Cisco ASA/FTD Scan Report, California Office of the Attorney General, Cisco August 2025 Semiannual Security Advisory Bundled Publication, CISA Directive (September 25, 2025), Cisco Security Advisory (CVE-2025-20333) and Wired.
What is the most recent URL for additional resources on cybersecurity best practices ?
Most Recent URL for Additional Resources: The most recent URL for additional resources on cybersecurity best practices is https://www.zerodayinitiative.com, https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-KLJ98X7Q, https://sec.cloudapps.cisco.com/security/center/publicationListing.x, https://www.cbc.ca/news/politics/cisco-cyberattack-cse-warning-1.7240000, https://www.cisa.gov/news-events/directives, https://cyber.gc.ca/en/guidance, https://www.ncsc.gov.uk/news, https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-arcane-door-2024, [1], [2] .
Investigation Status
What is the current status of the most recent investigation ?
Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing monitoring for exploitation attempts.
Stakeholder and Customer Advisories
What was the most recent stakeholder advisory issued ?
Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was Urgent patching recommended for all affected organizations., Cisco customers using FMC with RADIUS authentication, Cisco PSIRT advisory with patching guidance, Urgent patching recommended for all affected organizations, Government agencies advised to audit ASA devices, Urgent patching directives for federal agencies (U.S.), Public warnings for critical infrastructure sectors (Canada, UK, Five Eyes), CISA directives to federal agencies, Public statements by Chris Butera (CISA), Cisco Customers, Federal Civilian Executive Branch (FCEB) Agencies, Global Organizations Using Cisco ASA/FTD, Cisco PSIRT advisory with fixed software details, .
What was the most recent customer advisory issued ?
Most Recent Customer Advisory: The most recent customer advisory issued were an Customers using Cisco Secure FMC with RADIUS enabled should apply updates or disable RADIUS immediately., Public security advisory with patch instructions, Urgent recommendation to apply patches or mitigate SNMP access, Cisco PSIRT notificationsPublic security bulletins, Cisco customer notifications (via security advisory)Guidance for organizations using Cisco ASA for VPNs, Apply Patches ImmediatelyMonitor for Indicators of Compromise (IoCs)Review VPN Access Logs for Unauthorized Activity and Urgent upgrade notice for affected versions.
Initial Access Broker
What was the most recent entry point used by an initial access broker ?
Most Recent Entry Point: The most recent entry point used by an initial access broker were an Smart Install Feature, Cisco switches, Hardcoded SSH credentials, Personal Google Account, Amazon Web Services, Compromised personal Google account, Crafted API requests and /aparchive/upload and /ap_spec_rec/upload/.
What was the most recent reconnaissance period for an incident ?
Most Recent Reconnaissance Period: The most recent reconnaissance period for an incident was Since 2024 (ArcaneDoor group activity), Late August 2024 (Greynoise Scans), July 2021 – November 2022.
Post-Incident Analysis
What was the most significant root cause identified in post-incident analysis ?
Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Credential Compromise via Voice Phishing, Erroneous Security Configuration, Zero-day vulnerability CVE-2024-20399, Remote Code Execution (RCE) through malicious file uploadsUnauthorized disclosure of sensitive information through privilege escalation, Unpatched Systems, Hardcoded tokens, Hard-coded JWT present in the Out-of-Band Access Point (AP) Image Download feature, Improper input validationInsufficient access controlsInadequate session validationJWT manipulationSession hijacking, Hardcoded SSH credentials left in the system during development phases, Insufficient user-supplied input validation checks, Insufficient validation of user-supplied input in specific APIs, Unsafe deserialization and command injection in the enableStrongSwanTunnel() method., Insufficient input validation in RADIUS authentication subsystem.Improper handling of user-supplied credentials during authentication., Improper input validation during RADIUS authenticationLack of sufficient privilege separation in authentication flow, Stack-based buffer overflow in SNMP subsystemInsufficient input validation for SNMP packets, Exploitation of unpatched zero-day vulnerabilities in legacy devicesLack of Secure Boot/Trust Anchor on ASA 5500-X SeriesUse of end-of-support hardware in critical infrastructureInsufficient logging/monitoring for advanced evasion techniques, Exploitation of unpatched vulnerabilities in Cisco ASATargeting of legacy systemsState-sponsored actor sophistication, Unpatched zero-day vulnerabilities in Cisco devicesInsufficient monitoring of high-value targets, Delayed Patching of Zero-Day VulnerabilitiesOver-Exposure of VPN Interfaces to the Public InternetLack of Temporary Mitigations (No Workarounds Available)Insufficient Monitoring for Early Indicators of Exploitation, Insufficient network segmentation allowing lateral movement post-initial access.Lack of detection for initial access brokerage activity.Vulnerabilities in Yanluowang’s encryption algorithm (later exploited by Kaspersky for decrypter).Use of cryptocurrency for ransom payments enabling anonymity., initial access brokerage enabling ransomware deploymentcredential theft/exploitationpotential vulnerabilities in corporate networks, Insufficient validation of user-supplied input in HTTP requests.
What was the most significant corrective action taken based on post-incident analysis ?
Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Patches and updates provided to users, Patching, Software updates and disabling vulnerable features, Update to the latest firmware versionsConfigure proper network segmentationImplement multi-factor authentication (MFA)Disable unnecessary servicesImplement strict firewall rulesRegularly audit user accounts with administrative privilegesMonitor for suspicious activities in SIEM systems, Apply patch ciscocm.CSCwp27755_D0247-1.cop.sha512Upgrade to 15SU3 release, Apply patches for CVE-2025-20337, Apply patches and enhanced fixed releases, Update to 3.3 Patch 7 and 3.4 Patch 2, Released patched software versions.Recommended disabling RADIUS authentication as a temporary mitigation., Software patch to fix input handlingEnhanced authentication validation mechanisms, Patch deployment (CVE-2025-20352, others)SNMP access restrictions, Accelerated EoS timelines for vulnerable devicesEnhanced firmware integrity checks in ASA softwareImproved detection for bootkit-level persistenceCollaboration with NCSC/CCCS for threat intelligence sharing, Mandatory vulnerability assessments (CISA directive)Patch management enforcement, Mandatory Patching Enforcement (e.g., CISA Directive)Network Segmentation for VPN Access PointsEnhanced Threat Detection for Malware (Line Viper, RayInitiator)Accelerated End-of-Support (EoS) Device Replacement, FBI disruption of Yanluowang operations via arrest/extradition of Volkov.Kaspersky’s public release of a free decrypter (2022).Heightened scrutiny of Russian-linked threat actors masquerading as other nationalities.Emphasis on tracing cryptocurrency transactions for attribution., Software patch (input validation fixes) released in versions 2.3.7.10-VA and later.
.png)
Latest Global CVEs (Not Company-Specific)
Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions 19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.
Risk Information
cvss4
Base: 7.7
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
References
- https://github.com/angular/angular/commit/0276479e7d0e280e0f8d26fa567d3b7aa97a516f
- https://github.com/angular/angular/commit/05fe6686a97fa0bcd3cf157805b3612033f975bc
- https://github.com/angular/angular/commit/3240d856d942727372a705252f7c8c115394a41e
- https://github.com/angular/angular/releases/tag/19.2.16
- https://github.com/angular/angular/releases/tag/20.3.14
- https://github.com/angular/angular/releases/tag/21.0.1
- https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37
Description
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs. This issue has been patched in version 1.3.2.
Risk Information
cvss4
Base: 8.7
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions. This issue has been patched in version 1.3.2.
Risk Information
cvss4
Base: 6.3
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, working with large buffers in Lua scripts can lead to a stack overflow. Users of Lua rules and output scripts may be affected when working with large buffers. This includes a rule passing a large buffer to a Lua script. This issue has been patched in versions 7.0.13 and 8.0.2. A workaround for this issue involves disabling Lua rules and output scripts, or making sure limits, such as stream.depth.reassembly and HTTP response body limits (response-body-limit), are set to less than half the stack size.
Risk Information
cvss3
Base: 7.5
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In versions from 8.0.0 to before 8.0.2, a NULL dereference can occur when the entropy keyword is used in conjunction with base64_data. This issue has been patched in version 8.0.2. A workaround involves disabling rules that use entropy in conjunction with base64_data.
Risk Information
cvss3
Base: 7.5
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Access Data Using Our API
Get company history
curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=cisco' -H 'apikey: YOUR_API_KEY_HERE'
RapidWhat Do We Measure ?
Incident
Finding
Grade
Digital Assets
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
These are some of the factors we use to calculate the overall score:
Network Security
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
SBOM (Software Bill of Materials)
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
CMDB (Configuration Management Database)
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Threat Intelligence
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.
Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.
