Hack av Cisco-servrar som stöder VIRL-PE-infrastrukturen

Företaget Cisco den första dokumenterade händelsen av en cyberattack, som huvudsakligen genomfördes av AI. En statligt stödd kinesisk grupp använde AI-agenter för att autonomt hacka cirka 30 mål världen över. AI:n genomförde själv mellan 80 % och 90 % av de taktiska operationerna. Detta inträffade redan innan agentbaserade system kraftigt förstärktes och innan nya farliga tillämpningsmetoder uppkom. information about the breach of 7 servers that support the operation of the network modeling system VIRL-PE (Virtual Internet Routing Lab Personal Edition), which allows for the design and testing of network topologies based on Cisco's communication solutions without real hardware. The breach was detected on May 7th. Control over the servers was gained through the exploitation of a critical vulnerability in the SaltStack centralized configuration management system, which had previously been used to compromise the infrastructures of LineageOS, Vates (Xen Orchestra), Algolia, Ghost, and DigiCert. The vulnerability was also present in third-party installations of Cisco CML (Cisco Modeling Labs Corporate Edition) and Cisco VIRL-PE versions 1.5 and 1.6 if the user enabled salt-master.

It should be noted that on April 29th vulnerabilities in Salt were fixed två sårbarheter, allowing code to be executed remotely on the controlling host (salt-master) and all servers managed through it without authentication.
For the attack, it is sufficient for network ports 4505 and 4506 to be accessible for external requests.

Källa: opennet.ru