Akira Ransomware and exploitation of Cisco Anyconnect vulnerability CVE-2020-3259

In several recent incident response missions, the Truesec CSIRT team made forensic observations indicating that the old vulnerability CVE-2020-3259 is likely to be actively exploited by the Akira ransomware group.

Truesec platform customers can already read the related threat notice in the Truesec portal.

Indications of Akira Ransomware group actively exploiting Cisco Anyconnect CVE-2020-3259

During the past weeks, the Truesec CSIRT team found forensic data indicating that the Akira Ransomware group might be actively exploiting an old Cisco ASA …

actively exploited akira akira ransomware anyconnect can cisco cisco anyconnect csirt customers cve exploitation exploited exploiting forensic incident incident response notice old platform portal ransomware ransomware group response team threat truesec vulnerability