This attack isn’t caused by a problem or vulnerability with a Cisco product. It results from an attacker stealing administrative credentials or getting physical access to a networking device, allowing them to load a modified version of operating system software.
Just as technology advances, so too do the nature and sophistication of attacks. Although Mandiant’s research focuses on a specific piece of malware, we believe that it is an example of an evolution of attacks. Attackers are no longer focusing just on disruption, but on compromising credentials to launch an undetected and persistent attack.
For many years we’ve known that networking devices and their credentials are high-value targets for attackers. There has always been a need to protect them accordingly. This was something we reinforced last month in this security bulletin: Evolution in Attacks Against Cisco IOS Software Platforms
We know this is an important topic for our customers, so have created an on-demand webcast outlining how to detect and remediate this type of attack:
The webcast also continues the conversation about good operating procedures, like network hardening and monitoring, that can help prevent this type of attack. The resources it describes can also be found on our Event Response Page.
If you have any additional questions about SYNful Knock, including how we can help implement some of these recommendations, please speak with your Cisco account manager.
If you are experiencing immediate technical challenges and require support, the Cisco Technical Assistance Center (TAC) is here to help.
And if you’re a member of the press with questions, please contact my PR friends at firstname.lastname@example.org.
Hi Team,We have 2 ISP with our Firepower and we are looking into redundancy for our AnyConnect VPN and we found the Backup Server.Our request:We just want AnyConnect to automatically reconnect to the Backup Server in the list when a remote anyconnect user...
Hello, For whatever reason ISE 2.3 3495 is extremely slow when accessing context visibility. All other page works fine. Except for when we filtered a identity group endpoint. We tried chrome and firefox. We also downloaded the ...
When our AnyConnect clients connect remotely, they get a 172.a.b.c address from our ASA and register this address with our DNS server, so everything is good... until they get back into the office.... when the client later boots up onto the corporate LAN, ...
We are trying to get our ISE 2.6 to take radius accounting packets (from Aruba Clearpass) and convert them into Identities to then pass off to our FMC and FTD. We are seeing the endpoints show up in ISE and we see all the correct information however ...