Summary
- Environment: Networking/Tech
- Operational impact: No ransomware deployed; some non-sensitive files exfiltrated
- Financial impact: No financial figure is established by the reviewed source evidence
- Record status: Developing record. Reviewed September 19, 2026; updated as evidence emerges.
What happened
In 2022, Cisco experienced an incident in its networking/tech environment. The retained source describes the attack path as follows: Yanluowang group; employee’s personal Google account synced corporate credentials, plus voice phishing and MFA fatigue. [1]
The documented consequence was: No ransomware deployed; some non-sensitive files exfiltrated. [1]
Impact
- Documented impact: No ransomware deployed; some non-sensitive files exfiltrated. [1]
- No financial loss, ransom amount, recovery cost, or regulatory penalty is established by the reviewed source evidence.
Timeline
Documented public update
The Cisco response to recent cyber attack records the incident facts used in this briefing.
[1]Briefing updated
This briefing was last reviewed and updated on September 19, 2026.
Threat Group & Attack Vector
The retained source describes the attack path as follows: Yanluowang group; employee’s personal Google account synced corporate credentials, plus voice phishing and MFA fatigue. The canonical record does not add intrusion steps beyond those supported by the source. [1]
Actors
- Yanluowang — identified in the supported attack description. [1]
TTPs
- T1566 — Phishing — mapped from the cited behavior. [1]
- T1621 — Multi-Factor Authentication Request Generation — mapped from the cited behavior. [1]
Response
The reviewed source does not describe containment, notification, or restoration steps in enough detail to summarize them responsibly.
This account is bounded to Cisco response to recent cyber attack. Details absent from that evidence are left unresolved rather than inferred. [1]