<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<span style="font-size:12pt;margin:0px;background-color:rgb(255, 255, 255)">Hello,</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<div style="font-size:12pt;margin:0px;background-color:rgb(255, 255, 255)">
<div style="margin:0px"><br>
</div>
<div style="margin:0px">I hope everyone is doing well!</div>
<div style="margin:0px"><br>
</div>
Below is the entry for today.</div>
<div style="margin:0px;background-color:rgb(255, 255, 255)"><br>
</div>
<div style="margin:0px;background-color:rgb(255, 255, 255)">08/11/2022 - Diary entry #572:</div>
<div style="margin:0px;background-color:rgb(255, 255, 255)"><br>
</div>
<blockquote style="background-color:rgb(255, 255, 255);margin-top:0px;margin-bottom:0px">
<div style="margin:0px"></div>
This week Cisco confirmed it was a victim of a breach in May this year. The confirmation comes after Yanlowang ransomware created a post on their wall of shame mentioning Cisco. So far no data is available for download, but the group claims to have stolen more
than 3 thousand files with a total size of 2.8GB.
<div><br>
</div>
<div>According to Cisco report, the initial breach was through a VPN appliance, after an employee's credential was compromised. The VPN appliance had MFA enabled, but the attackers used "MFA fatigue" - a technique consisting of flooding the user's authentication
app with push notification in the hope they will accept the request by accident and enable access to the attackers - to gain initial foothold. After the initial access, the attacker started to move laterally in the network, enrolling new devices for MFA and
getting privileged access.</div>
<div><br>
</div>
Cisco claims the incident generated no impact to their products or customers, since the intrusion was detected and the threat actor's access was terminated. The attack is being attributed to Lapsus$ (covered more recently in our Daily Diary #477), along with
Yanluowang ransomware (covered in our Daily Diary #402) - although no ransomware was deployed in the environment. Still according to Cisco, the only data accessed by the attackers was in a Box cloud storage directory for the compromised employee's account,
which does not contain private or valuable data.
<div style="margin:0px"></div>
</blockquote>
<span style="margin:0px;background-color:rgb(255, 255, 255)"></span><span style="background-color:rgb(255, 255, 255);display:inline !important">Kind Regards,</span><br>
</div>
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
</div>
<div></div>
<div></div>
<div></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<table style="font-family:"Times New Roman"; font-size:medium; text-align:start">
<tbody>
<tr>
<td width="180" align="left" style="width:180px">
<table width="120" align="left">
<tbody>
<tr>
<td colspan="3" align="center"><a href="https://www.appgate.com/"><img alt="" width="120" height="30" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/logo@2x.png"></a></td>
</tr>
<tr>
<td colspan="3" align="center"> </td>
</tr>
<tr>
<td width="37%" align="center"><a href="https://www.linkedin.com/company/appgate-security/"><img width="18" height="18" alt="" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/likedin@2x.png"></a></td>
<td width="28%"><a href="https://twitter.com/AppgateSecurity"><img width="20" height="18" alt="" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/twitter@2x.png"></a></td>
<td width="35%"><a href="https://www.youtube.com/channel/UC-8GvxcZbm-R3EJNl8jYjiQ"><img width="26" height="18" alt="" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/youtube@2x.png"></a></td>
</tr>
</tbody>
</table>
<p> </p>
</td>
<td width="350" colspan="2" rowspan="2" style="width:350px">
<p style="font-family:Arial,Helvetica,sans-serif; font-size:13px; color:rgb(12,12,12)">
<strong>Felipe Duarte Domingues</strong><br>
Manager, MART<br>
<strong>Appgate</strong></p>
<p style="font-family:Arial,Helvetica,sans-serif; font-size:13px; color:rgb(12,12,12)">
E:<span> </span><font color="#228ebe"><a href="mailto:felipe.duarte@appgate.com" title="mailto:felipe.duarte@appgate.com">felipe.duarte@appgate.com</a></font></p>
</td>
</tr>
</tbody>
</table>
<br>
</div>
</div>
</div>
</div>
</body>
</html>