How Cisco Got Hacked by the Yanluowang Extortion Crew
A Personal Browser Became the Front Door
The first domino was a habit that lives on millions of machines: letting a browser remember work logins while signed into a personal account. When the intruder took over that employee's Google profile, the synced vault came with it, and corporate credentials arrived without a single line of malware. Password reuse and sync are the quiet workhorses of modern intrusion, and they cost the attacker nothing but patience. Stolen credentials alone should have been a dead end, because remote access sat behind a second factor. That is where social engineering entered. Phone calls came in from someone claiming to represent a trusted support organization, speaking fluent English with the right vocabulary and the right urgency. In parallel, the account began generating a stream of approval prompts on the employee's phone. Together the two channels told a consistent story: something is wrong, we are fixing it, please confirm. After enough repetitions the employee tapped accept, and a virtual private network session opened under a legitimate identity. From the logs, everything looked like an ordinary remote workday.
Why Push Prompt Spam Beats a Locked Phone
The push-approval model asks a human to be the final firewall, dozens of times a day, on a screen full of other notifications. Flooding that channel, a technique widely known as an MFA fatigue attack, weaponizes ordinary annoyance. Prompts arrive at 2am, during a meeting, in a queue at the airport, and each one carries no context about who asked or from where. Eventually somebody taps to make the buzzing stop, or taps thinking it is the login they just attempted themselves. Bolting a voice call onto that pressure removes the last hesitation. Voice phishing supplies a friendly explanation for the noise, and it borrows authority that a silent prompt lacks. Defenders have two practical answers. Number matching forces the person to read a code off the screen they are actually logging into, which breaks blind approval. Hardware tokens speaking FIDO2 go further, because the cryptographic challenge is bound to the real domain and cannot be relayed by a caller on the phone. Rate limiting repeated prompts and alerting on bursts of denials closes the remaining gap.
From One Session to Domain Administrator
Once inside the network, the intruder behaved like an unhurried consultant. Enrolling new devices under the victim's identity kept access alive when the original session dropped. Reconnaissance followed with tooling that any systems administrator would recognize: adfind for directory queries, ntdsutil for touching the domain database, secretsdump for pulling credential material out of memory and registry hives. Nothing exotic showed up on disk, which is precisely the point of living off the tools already sanctioned in the environment. Movement went from workstation to Citrix infrastructure, the layer serving virtual desktops and published applications, and from there onto domain controllers. Owning a domain controller effectively means owning identity, since accounts can be created, group memberships edited and tickets forged at will. Attempts were also made to escalate privileges through CVE-2022-24521, a flaw in the Common Log File System driver that Microsoft patched in April 2022 after reports from the NSA and CrowdStrike. Those attempts failed. A small backdoor gave remote command execution as insurance, and detection signatures for both the implant and the exploit binary were later published so other defenders could hunt for the same artifacts.
After Cisco Was Hacked: Eviction and Stolen Files
Investigators caught the activity and removed the access, and that is where the story diverges from the usual grim ending. Over the following weeks the same actor kept trying to return, rotating usernames, refreshing stolen credentials, and adjusting techniques after each failure. Every attempt was blocked, which says as much about sustained monitoring as it does about the original mistake. What did leave was a set of documents from a cloud storage folder tied to the compromised account: agreements, drawings and exported data described as non-sensitive. Company statements said customer records, employee information, proprietary source and supply chain systems were untouched, and that no encryption payload was executed anywhere. The Yanluowang ransomware group answered by publishing a directory listing on its leak page, a favorite pressure tactic because a plausible index costs nothing and forces the victim to argue about scope in public. The gap between a claimed archive and a verified one is where most extortion negotiation actually happens, and refusing to pay usually guarantees the listing goes up.
The Crew, Its Neighbors and Its Business Model
The Yanluowang ransomware group had spent months hitting corporate targets before this incident, and analysts placed the intrusion set in the neighborhood of UNC2447 and the noisy Lapsus$ collective, groups known for phone-based manipulation rather than novel exploit development. Attribution at that resolution is a judgment call built from tool overlap, timing and behavioral fingerprints, not a signed confession. The economics deserve attention. Access to a corporate network is a commodity, brokered by specialists who never deploy encryption themselves and sell footholds to whoever pays. A buyer then chooses the profitable path: encrypt and demand a key fee, quietly steal and extort over publication, or resell the access again. The Cisco case shows the middle route, and it explains why security teams increasingly treat data theft as the main event rather than the prelude. This same crew claimed a Walmart breach around the same period, a claim the retailer rejected, and inflated claims are ordinary marketing in a business where reputation drives ransom size.
Reading the Case as a Defender
Strip the brand names away and the intrusion is a template. Credentials leak from somewhere outside corporate control. A second factor is defeated by pestering a human instead of breaking mathematics. Standard administrative binaries do the reconnaissance. Identity infrastructure becomes the objective. Files get staged out of a cloud folder because that is where documents already live. Every step is boring individually and devastating in sequence. That template is why the published technical detail mattered to everyone else. Indicators, tool names, exploit specifics and detection signatures let other teams write queries against their own telemetry and check whether the same footprints exist. Agencies including the FBI and CISA have issued repeated advisories describing this exact chain, from broker to extortion, and prosecutions have shown network access changing hands for four-figure sums before the real damage begins. Publishing the anatomy of a failure is uncomfortable and useful, and the alternative is a market where only attackers share notes.
Practical Steps That Break This Chain
Start where the attack started. Keep work credentials out of personal browsers and personal cloud profiles, enforce that with policy and with browser management rather than trusting good intentions, and give staff a managed password vault so the shortcut is unnecessary. Retire push approval as the primary second factor. Number matching is a same-week configuration change in most identity platforms, and security keys are a purchase order rather than a project. Then prepare the human layer. Tell people plainly that support will never phone and ask them to approve a prompt, give them a single reporting channel, and make it safe to report a tap they regret, because minutes matter more than blame. On the technical side, alert on device enrollment, on directory enumeration patterns, on credential dumping tools and on logins from unexpected locations or hours. Patch quickly, since the exploit tried here had been fixed roughly two months earlier. Finally, rehearse eviction, because as this case shows, an attacker pushed out will keep rattling the doors for weeks.
Frequently asked questions
How did the intruder get past two-factor authentication?
By exhausting the person holding it. Work credentials came out of a hijacked personal Google account, then approval prompts were fired repeatedly while a caller posed as trusted support. One tap opened a VPN session under the employee's identity, with no software exploit involved.
Was any ransomware actually executed on Cisco systems?
No encryption payload ran. The activity matched the staging phase that normally comes before deployment: reconnaissance, credential dumping, privilege escalation attempts and file theft. Pressure came from threatening to publish the documents instead of from locked machines.
How much data was taken and how sensitive was it?
The extortion page advertised roughly 2.75GB across about 3,100 files pulled from a cloud storage folder linked to the compromised account, including agreements and engineering drawings. Company statements said the content was non-sensitive and that customer, employee and supply chain systems were unaffected.
Which tools and vulnerabilities appeared in the intrusion?
Directory and credential tooling such as adfind, ntdsutil and secretsdump did the discovery work, a small implant provided remote command execution, and there were failed attempts to abuse CVE-2022-24521 in the Common Log File System driver, a bug Microsoft had already patched in April 2022.
What single change would stop this attack pattern?
Removing blind push approval. Number matching makes the user read a code from the genuine login screen, and FIDO2 security keys bind the challenge to the real site so a phone caller cannot relay it. Pair that with keeping work passwords out of personal browser sync.