Hacker Target Security Software Used by Remote Workers

 

          Image credit:The Hacker News                                 Cisco logo

The Real Deal

According to CNBC news ,  government cyber agencies all over the world are reporting that we are in the midst of what appears to be a very advanced counterintelligence operation that is going after remote staff’s main security systems.

Labeling the threat as very serious and urgent, Canada's Communications Security Establishment's Centre for Cyber Security, collaborating with its international partners, reported on Thursday that organizations should immediately patch vulnerabilities exploited in a large-scale attack on Cisco.He said ,"When there's a cyber security problem, remote workers make use of the opportunity to set up their Virtual Private Network".

CSE further explained that the issue is very crucial because critical infrastructure sectors such as municipal, provincial, and territorial governments, as well as academia, and research institutions need to implement the recommendations.

"This is an important time for Canadian organizations," said the Chief of the Canadian Centre for Cyber Security in a Thursday issue. "We see an increase in sophisticated attacks on out-of-date systems by threat actors, and I urge all critical infrastructure sectors to act now". 

In a press release, Cisco reported that in May, it first became aware of an attack which affected its adaptive security appliances (ASA). It was also reported that the same threat actor exploited new vulnerabilities in ASA products. The actor planted malware, ran commands, and may also have extracted data from the affected devices.

Cisco reported that the attack is from the same groups that are responsible for the ArcaneDoor campaign, which happened to be a state-sponsored counterintelligence operation.

You can also read:Ninety Percent of Coding Expert Are Now Using AI Says Google

CSE did not reveal the true identity of the  attackers and advised that they were still looking into the extent of the vulnerabilities in Canada.

"It is an important warning," a spokesperson said in an email to CBC News.

Mike Gropp reported that a broken front door has been found on the very devices that are meant to protect corporate and government networks.

He noted that Cisco’s firewalls are at the perimeter of thousands of Canadian organizations including banks,hospitals, utilities and public agencies.

"When these devices are compromised by attackers they may also surreptitiously watch, steal, or redirect all the traffics that pass through them", he said.

A large-scale attack may cause the release of private information, including patient and financial details and governmental communications. This, in turn, could bring down important services.

Mike Gropp, who works with Rogers Cybersecure Catalyst, reported that the recent Cisco attack exhibits a pattern very much in the style of what state-sponsored attackers do. This includes actors from China and Russia, who focus on being quiet and hard to detect to gain political and geographic advantage. Such actors search for government communications and also into early details of emerging technologies.They may also be penetrating systems for the purpose of long term strategic goals.

He further stressed that collecting important information like network architecture, security measures, and software can be used against us during critical periods like war or trade negotiations. This in turn creates leverage that will provide strategic advantages.

In May 2025, PCMag reported that a government-backed hacking group managed to hack ConnectWise, a company that distributes remote support software that is mostly used in Information Technology administration.

The attack had raised global alarm.

CISA which doesn’t often issue emergency directives put out one on Thursday in regard to the ongoing Cisco issue and was calling for all federal civilian agencies to patch up vulnerabilities by Friday at midnight.

This activity is a great risk to victim networks, the US directive reported.

United Kingdom Also Feels Concern

The UK’s National Cyber Security Centre (NCSC) reported that what they were seeing in this attack was on a different scale, not only in terms of sophistication but also in terms of the hackers' ability to go undetected.

CSE reported that it is working with Cisco and the Five Eyes intelligence community to provide assistance.

Editorial Thought 

The issue of cyberattack is really alarming these days. Different groups of hackers are targeting many government agencies around the world to get vital information they can use to carry out their malicious acts.

In November 2024 ,  Bank of America experienced a data breach through a third party vendor called LockBit Ransomware Group.

In Nigeria, a study revealed by  ScienceDirect.com showed 80% of Nigeria banks was affected by cyberattack .In August 2024, GTB also reported that their website was attacked.

The issue of putting cyberattacks to rest must be a collective effort among the industry stakeholders and governments around the world, if they truly want to combat it.

Also, different strict measures need to put in place to put an end to cyberattacks.