Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. While credential theft remains their primary entry method, researchers confirmed exploitation of Cisco’s CVE-2018-0171 Smart Install Remote Code Execution vulnerability in at least one breach. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. Cisco stresses disabling non-essential services (Smart Install, Guest Shell) and enforcing NETCONF/RESTCONF encryption as critical safeguards against future LOTL-based attacks. Attackers exfiltrated configurations containing weakly encrypted SNMP community strings and local account credentials, enabling lateral movement through GRE tunnels and modified loopback interfaces. Cisco’s analysis revealed strategic use of network appliances as stealthy hop points for data exfiltration, with some intrusions targeting secondary telecoms solely to reach primary objectives. A critical security flaw in Sitevision CMS versions 10.3.1 and older has exposed SAML authentication signing keys, enabling potential authentication bypass and session hijacking. Cisco Talos has uncovered a sophisticated cyberespionage campaign by the state-aligned “Salt Typhoon” group targeting U.S. telecommunications infrastructure since late 2024. This Golang-based ELF binary creates encrypted packet capture chains through compromised Cisco Nexus devices’ Guest Shell environments. Despite partial success exploiting CVE-2018-0171, most intrusions relied on unpatched legacy systems and credential mismanagement rather than zero-day vulnerabilities. Tushar is a Cyber security content editor with a passion for creating captivating and informative content. Cisco’s forensic teams observed password decryption attacks against weak Type 4/5 hashes, emphasizing the need for Type 8 (PBKDF2-SHA-512) encryption. The attackers maintained persistent access for over three years in some networks, employing advanced living-off-the-land (LOTL) techniques across multi-vendor environments. Mitigation requires immediate patching of CVE-2018-0171 and related vulnerabilities (CVE-2023-20198, CVE-2024-20399), alongside radical hardening of TACACS+/RADIUS implementations. The campaign leverages stolen credentials and network device misconfigurations to pivot between telecom operators’ systems.
This Cyber News was published on cybersecuritynews.com. Publication date: Sat, 22 Feb 2025 05:00:17 +0000