Gov’t Networks Breached Using Cisco Talos Zero-Day Exploits

Cisco Talos recently reported governments using their network firewall protection were breached by a global cyber-espionage campaign. Cisco investigators unveiled a sophisticated hacking operation exploiting two zero-day flaws. It’s believed espionage is the reason behind the attacks.

Chinese nation-state actors are suspected behind the campaign dubbed “ArcaneDoor” by Cisco. The zero-day exploits were used to breach government firewalls for several months as part of the espionage effort. Attackers used the flaws to inject malware into the networks to collect highly sensitive data for their campaign.

Cisco Talos reports the state-sponsored hacking group behind the attacks track as UAT4356, also known as Storm-1849. It appears the group may have been preparing for the strikes months before they began. According to the investigation, UAT4356 used highly sophisticated attention to detail in an effort to hide their digital footprints and evade detection.

It’s believed Chinese actors are behind this attack and both China and Russia have previously targeted Cisco routers with espionage as the goal. In a recent string of attacks by China leveraging similar zero-day flaws, Fortinet, VMware, Barracuda Networks, and others have also been targeted.

Cisco released patches for both zero-day flaws, with their investigation emphasizing the importance of immediate patching "As a critical path for data into and out of the network, these devices need to be routinely and promptly patched…”  This not only applies to this issue, but any security patch that’s released for any product should be applied right away to mitigate risk of being a victim of cyberattacks.

Cisco hasn’t made public those governments victimized by the cyber-espionage attacks, nor did they reveal how many were involved.

Something this attack by UAT4356 points to is the growing number of similar strikes by state-sponsored actors. Their ability to exploit zero-day flaws, especially with espionage as the goal, is at best disturbing. No doubt, governments, cybersecurity experts, and providers alike have their work cut out for them.