![](\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&iu=\/6978\/reg_security\/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YvTRXbjq3k3EfeGCwUxstgAAAE4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\")
<\/a> <\/noscript> <\/div>\nOnce inside, they spread laterally to Citrix servers \u2013 eventually obtaining privileged access to domain controllers. As domain admin, they operated tools like ntdsutil, adfind and secretsdump to exfiltrate data and install a backdoor and other payloads.<\/p>\n
Cisco was able to revoke the attacker’s access, but that did not discourage them. They tried to re-establish entry multiple times, preying on employees’ weak password rotation hygiene. The attacker then attempted to establish email communication with Cisco execs, showing off directory listings of their loot \u2013 an alleged 2.75GB of data containing around 3,700 files \u2013 and suggesting Cisco could pay to avoid disclosure.<\/p>\n
“Based upon artefacts obtained, tactics, techniques, and procedures (TTPs) identified, infrastructure used, and a thorough analysis of the backdoor utilized in this attack, we assess with moderate to high confidence that this attack was conducted by an adversary that has been previously identified as an initial access broker (IAB) with ties to both UNC2447 and Lapsus$,” said Cisco, adding activity was also linked to the Yanluowang ransomware gang.<\/p>\n
Yanluowang has claimed credit for the breach.<\/p>\n