Cisco was reported to have had its source code stolen by threat actors following an attack linked to the recent supply chain attack against Aqua Security's Trivy vulnerability scanner, according to BleepingComputer.
Threat actors who harnessed an illicit GitHub Action plugin from the Trivy hack were able to compromise Cisco's build and development environment, enabling the theft of credentials and data from dozens of devices, said a source close to the matter. Exfiltrated AWS keys were also noted to have been exploited to infiltrate a limited number of Cisco AWS accounts.
Such an incident, which has already been contained, was later discovered by BleepingComputer to have led to the cloning of over 300 Cisco GitHub repositories, including source code for the firm's AI Assistant, AI Defense, and other AI-based offerings, as well as the theft of repositories purportedly owned by U.S. government agencies, banks, and business process outsourcing firms. Additional compromise from subsequent LiteLLM and Checkmarx supply chain incidents is expected by Cisco, noted the source.
