Hackers Hit Hundreds of Cisco Firewalls in US Government

Core Insights - Hackers have compromised firewall devices within the US government, raising concerns about cyberattacks on Cisco Systems' widely-used devices [1][4] - The US Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive requiring federal agencies to address vulnerabilities in Cisco firewall devices [2][5] - The hackers, identified as ArcaneDoor, have been conducting cyber-espionage campaigns since 2024, affecting critical infrastructure in the US [6][7] Group 1: Cybersecurity Threats - The compromised access allows intruders to take full control of firewalls, disable security protections, and access internal systems [3] - The threat is widespread, with CISA urging not only federal agencies but also private companies to follow the guidance [4] - The hackers exploit vulnerabilities that persist through reboots and system upgrades, posing a significant risk [5] Group 2: Government Response - CISA's directive required federal agencies to identify and mitigate potential breaches in hundreds of Cisco firewall devices [2] - Agencies were given a deadline to hunt for evidence of compromised devices and report findings to CISA [5] - The UK's National Cyber Security Centre also issued an alert regarding the exploitation of these vulnerabilities [5] Group 3: Ongoing Monitoring - Cybersecurity firm Palo Alto Networks has been tracking the hackers and noted a shift in their focus towards US entities [7] - There is an expectation of escalating attacks as cybercriminal groups learn to exploit these vulnerabilities [8]