Velvet Ant Strikes Again: Cisco Switch Exploit Sparks Cybersecurity Panic
Velvet Ant exploited CVE-2024-20399 to seize control of Cisco switches, evading detection with bespoke malware. The zero-day flaw allowed arbitrary command execution, leading to persistent access and data exfiltration. This stealthy campaign underscores the risks of third-party appliances in organizational networks.
Hot Take:
Just when you thought your Cisco switch was only good for managing traffic, Velvet Ant turns it into a hot rod for cyber espionage. Who knew appliances could have such an exciting double life?
Key Points:
- Cisco switches exploited by Velvet Ant using CVE-2024-20399.
- Attack involves escaping CLI to execute arbitrary commands on Linux OS.
- Velvet Ant’s activities traced back to a multi-year campaign.
- Payload VELVETSHELL combines Tiny SHell and 3proxy tools.
- Attack raises concerns about the risks of third-party appliances.
Already a member? Log in here