Hackers Secretly Bleeding Cisco Networks Since 2023. Now CISA Demands Action

Hackers just pulled off a massive, multi-year heist right under our noses.

Since 2023, attackers have quietly exploited a critical flaw in Cisco enterprise hardware. Plus, they targeted major organizations and government systems.

So, if you manage large-scale networks, this news demands your immediate attention.

This Catalyst SD-WAN Vulnerability Is Brutal

Let’s look at the specific hardware. The bug impacts Cisco Catalyst SD-WAN products.

Large enterprises use these tools to connect remote offices across vast distances. But that convenience currently comes with a massive security tradeoff.

The vulnerability carries a maximum severity score of 10.0. Essentially, that means the flaw cannot get any worse. Hackers can use it to completely take over a network remotely from across the internet.

Threat Actors Kept Persistent Hidden Access

Breaking in was only the first step. Once inside, these attackers grabbed the highest possible system permissions.

Then, they set up persistent hidden access. This allowed them to stay completely invisible while quietly spying on network traffic.

Furthermore, they successfully stole sensitive data over long periods without triggering alarms. We still do not know exactly who these hackers are. However, security teams currently track this specific threat group as UAT-8616.

Critical Infrastructure and CISA Take a Hit

The victim list looks incredibly serious. Cisco researchers confirmed that some targets include critical infrastructure organizations.

That means power grids, water supplies, or transportation networks might be compromised. As a result, global cybersecurity agencies are stepping in fast.

The U.S., UK, Canada, Australia, and New Zealand all issued severe warnings this week. Also, the U.S. cybersecurity agency (CISA) ordered civilian federal agencies to patch systems immediately by Friday. Keep in mind, CISA is currently operating under a partial government shutdown. Yet, they still flagged this as an imminent, unacceptable risk.

Sadly, this follows another recent nightmare. Just last December, Cisco warned about a similarly exploited 10.0 vulnerability in its Async software.

This mess highlights a terrifying reality about modern networking equipment. A single unpatched flaw can leave an entire organization vulnerable for years.

If your company uses these Cisco products, you must apply the patches today. Do not wait for the weekend.

Plus, security teams need to actively hunt for signs of a past breach. After all, closing the door now does not help if hackers already live inside your servers.